{"schema_version":"1.0","generated":"2026-08-20","source":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json","domain":"Enterprise","version":"19.2","boundary":"Official MITRE ATT&CK group-to-technique procedure relationships and available public citations. This reference layer is not a HECAVEX attribution or current-activity assessment.","groups":[{"id":"G0018","name":"admin@338","procedures":[{"technique_id":"T1007","description":"admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: net start >> %temp%\\download","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"technique_id":"T1016","description":"admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: ipconfig /all >> %temp%\\download","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"technique_id":"T1036.005","description":"admin@338 actors used the following command to rename one of their tools to a benign file name: ren \"%temp%\\upload\" audiodg.exe","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"technique_id":"T1049","description":"admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: netstat -ano >> %temp%\\download","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"technique_id":"T1059.003","description":"Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer.","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"technique_id":"T1069.001","description":"admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: net localgroup administrator >> %temp%\\download","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"technique_id":"T1082","description":"admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: ver >> %temp%\\download systeminfo >> %temp%\\download","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"technique_id":"T1083","description":"admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: dir c:\\ >> %temp%\\download dir \"c:\\Documents and Settings\" >> %temp%\\download dir \"c:\\Program Files\\\" >> %temp%\\download dir d:\\ >> %temp%\\download","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"technique_id":"T1087.001","description":"admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: net user >> %temp%\\download net user /domain >> %temp%\\download","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"technique_id":"T1203","description":"admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158.","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"technique_id":"T1204.002","description":"admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails.","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]},{"technique_id":"T1566.001","description":"admin@338 has sent emails with malicious Microsoft Office documents attached.","sources":[{"source":"FireEye admin@338","url":"https://www.fireeye.com/blog/threat-research/2015/11/china-based-threat.html"}]}]},{"id":"G1030","name":"Agrius","procedures":[{"technique_id":"T1003.001","description":"Agrius used tools such as Mimikatz to dump LSASS memory to capture credentials in victim environments.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1003.002","description":"Agrius dumped the SAM file on victim machines to capture credentials.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1005","description":"Agrius gathered data from database and other critical servers in victim environments, then used wiping mechanisms as an anti-analysis and anti-forensics mechanism.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1018","description":"Agrius used the tool NBTscan to scan for remote, accessible hosts in victim environments.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1021.001","description":"Agrius tunnels RDP traffic through deployed web shells to access victim environments via compromised accounts. Agrius used the Plink tool to tunnel RDP connections for remote access and lateral movement in victim environments.","sources":[{"source":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"},{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1036","description":"Agrius used the Plink tool for tunneling and connections to remote machines, renaming it systems.exe in some instances.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1041","description":"Agrius exfiltrated staged data using tools such as Putty and WinSCP, communicating with command and control servers.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1046","description":"Agrius used the open-source port scanner WinEggDrop to perform detailed scans of hosts of interest in victim networks.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1059.003","description":"Agrius uses ASPXSpy web shells to enable follow-on command execution via cmd.exe.","sources":[{"source":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"technique_id":"T1074.001","description":"Agrius has used the folder, C:\\\\windows\\\\temp\\\\s\\\\, to stage data for exfiltration.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1078.002","description":"Agrius attempted to acquire valid credentials for victim environments through various means to enable follow-on lateral movement.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1110","description":"Agrius engaged in various brute forcing activities via SMB in victim environments.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1110.003","description":"Agrius engaged in password spraying via SMB in victim environments.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1119","description":"Agrius used a custom tool, sql.net4.exe, to query SQL databases and then identify and extract personally identifiable information.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1140","description":"Agrius has deployed base64-encoded variants of ASPXSpy to evade detection.","sources":[{"source":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"technique_id":"T1190","description":"Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices and SQL injection activity.","sources":[{"source":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"technique_id":"T1505.003","description":"Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.","sources":[{"source":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"technique_id":"T1543.003","description":"Agrius has deployed IPsec Helper malware post-exploitation and registered it as a service for persistence.","sources":[{"source":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"technique_id":"T1560.001","description":"Agrius used 7zip to archive extracted data in preparation for exfiltration.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]},{"technique_id":"T1570","description":"Agrius downloaded some payloads for follow-on execution from legitimate filesharing services such as ufile.io and easyupload.io.","sources":[{"source":"CheckPoint Agrius 2023","url":"https://research.checkpoint.com/2023/agrius-deploys-moneybird-in-targeted-attacks-against-israeli-organizations/"}]},{"technique_id":"T1583","description":"Agrius typically uses commercial VPN services for anonymizing last-hop traffic to victim networks, such as ProtonVPN.","sources":[{"source":"SentinelOne Agrius 2021","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]},{"technique_id":"T1685","description":"Agrius used several mechanisms to try to disable security tools. Agrius attempted to modify EDR-related services to disable auto-start on system reboot. Agrius used a publicly available driver, GMER64.sys typically used for anti-rootkit functionality, to selectively stop and remove security software processes.","sources":[{"source":"Unit42 Agrius 2023","url":"https://unit42.paloaltonetworks.com/agonizing-serpens-targets-israeli-tech-higher-ed-sectors/"}]}]},{"id":"G0130","name":"Ajax Security Team","procedures":[{"technique_id":"T1056.001","description":"Ajax Security Team has used CWoolger and MPK, custom-developed malware, which recorded all keystrokes on an infected system.","sources":[{"source":"Check Point Rocket Kitten","url":"https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"}]},{"technique_id":"T1105","description":"Ajax Security Team has used Wrapper/Gholee, custom-developed malware, which downloaded additional malware to the infected system.","sources":[{"source":"Check Point Rocket Kitten","url":"https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"}]},{"technique_id":"T1204.002","description":"Ajax Security Team has lured victims into executing malicious files.","sources":[{"source":"FireEye Operation Saffron Rose 2013","url":"https://www.mandiant.com/sites/default/files/2021-09/rpt-operation-saffron-rose.pdf"}]},{"technique_id":"T1555.003","description":"Ajax Security Team has used FireMalv custom-developed malware, which collected passwords from the Firefox browser storage.","sources":[{"source":"Check Point Rocket Kitten","url":"https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"}]},{"technique_id":"T1566.001","description":"Ajax Security Team has used personalized spearphishing attachments.","sources":[{"source":"Check Point Rocket Kitten","url":"https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"}]},{"technique_id":"T1566.003","description":"Ajax Security Team has used various social media channels to spearphish victims.","sources":[{"source":"FireEye Operation Saffron Rose 2013","url":"https://www.mandiant.com/sites/default/files/2021-09/rpt-operation-saffron-rose.pdf"}]}]},{"id":"G1024","name":"Akira","procedures":[{"technique_id":"T1018","description":"Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.","sources":[{"source":"Arctic Wolf Akira 2023","url":"https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/"}]},{"technique_id":"T1021.001","description":"Akira has used RDP for lateral movement.","sources":[{"source":"Cisco Akira Ransomware OCT 2024","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}]},{"technique_id":"T1027.001","description":"Akira has used binary padding to obfuscate payloads.","sources":[{"source":"Cisco Akira Ransomware OCT 2024","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}]},{"technique_id":"T1036.005","description":"Akira has used legitimate names and locations for files to evade defenses.","sources":[{"source":"Cisco Akira Ransomware OCT 2024","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}]},{"technique_id":"T1059.001","description":"Akira has used PowerShell scripts for credential harvesting and privilege escalation.","sources":[{"source":"Cisco Akira Ransomware OCT 2024","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}]},{"technique_id":"T1078","description":"Akira uses valid account information to remotely access victim networks, such as VPN credentials.","sources":[{"source":"Cisco Akira Ransomware OCT 2024","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"},{"source":"Secureworks GOLD SAHARA","url":"https://www.secureworks.com/research/threat-profiles/gold-sahara"},{"source":"Arctic Wolf Akira 2023","url":"https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/"}]},{"technique_id":"T1133","description":"Akira uses compromised VPN accounts for initial access to victim networks.","sources":[{"source":"Secureworks GOLD SAHARA","url":"https://www.secureworks.com/research/threat-profiles/gold-sahara"}]},{"technique_id":"T1213.002","description":"Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.","sources":[{"source":"Secureworks GOLD SAHARA","url":"https://www.secureworks.com/research/threat-profiles/gold-sahara"}]},{"technique_id":"T1219","description":"Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.","sources":[{"source":"Secureworks GOLD SAHARA","url":"https://www.secureworks.com/research/threat-profiles/gold-sahara"},{"source":"Arctic Wolf Akira 2023","url":"https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/"}]},{"technique_id":"T1482","description":"Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.","sources":[{"source":"Arctic Wolf Akira 2023","url":"https://arcticwolf.com/resources/blog/conti-and-akira-chained-together/"}]},{"technique_id":"T1486","description":"Akira encrypts files in victim environments as part of ransomware operations.","sources":[{"source":"CISA Akira Ransomware APR 2024","url":"https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"},{"source":"BushidoToken Akira 2023","url":"https://blog.bushidotoken.net/2023/09/tracking-adversaries-akira-another.html"}]},{"technique_id":"T1531","description":"Akira deletes administrator accounts in victim networks prior to encryption.","sources":[{"source":"Secureworks GOLD SAHARA","url":"https://www.secureworks.com/research/threat-profiles/gold-sahara"}]},{"technique_id":"T1558","description":"Akira have used scripts to dump Kerberos authentication credentials.","sources":[{"source":"Cisco Akira Ransomware OCT 2024","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}]},{"technique_id":"T1560.001","description":"Akira uses utilities such as WinRAR to archive data prior to exfiltration.","sources":[{"source":"Secureworks GOLD SAHARA","url":"https://www.secureworks.com/research/threat-profiles/gold-sahara"}]},{"technique_id":"T1567.002","description":"Akira will exfiltrate victim data using applications such as Rclone.","sources":[{"source":"Secureworks GOLD SAHARA","url":"https://www.secureworks.com/research/threat-profiles/gold-sahara"}]},{"technique_id":"T1657","description":"Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.","sources":[{"source":"CISA Akira Ransomware APR 2024","url":"https://www.cisa.gov/sites/default/files/2024-04/aa24-109a-stopransomware-akira-ransomware_2.pdf"},{"source":"BushidoToken Akira 2023","url":"https://blog.bushidotoken.net/2023/09/tracking-adversaries-akira-another.html"}]},{"technique_id":"T1685","description":"Akira has disabled or modified security tools for defense evasion.","sources":[{"source":"Cisco Akira Ransomware OCT 2024","url":"https://blog.talosintelligence.com/akira-ransomware-continues-to-evolve/"}]}]},{"id":"G0138","name":"Andariel","procedures":[{"technique_id":"T1005","description":"Andariel has collected large numbers of files from compromised network systems for later extraction.","sources":[{"source":"FSI Andariel Campaign Rifle July 2017","url":"https://fsiceat.tistory.com/2"}]},{"technique_id":"T1027.003","description":"Andariel has hidden malicious executables within PNG files.","sources":[{"source":"MalwareBytes Lazarus-Andariel Conceals Code April 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/"},{"source":"Kaspersky Andariel Ransomware June 2021","url":"https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/"}]},{"technique_id":"T1049","description":"Andariel has used the netstat -naop tcp command to display TCP connections on a victim's machine.","sources":[{"source":"Kaspersky Andariel Ransomware June 2021","url":"https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/"}]},{"technique_id":"T1057","description":"Andariel has used tasklist to enumerate processes and find a specific string.","sources":[{"source":"Kaspersky Andariel Ransomware June 2021","url":"https://securelist.com/andariel-evolves-to-target-south-korea-with-ransomware/102811/"}]},{"technique_id":"T1105","description":"Andariel has downloaded additional tools and malware onto compromised hosts.","sources":[{"source":"AhnLab Andariel Subgroup of Lazarus June 2018","url":"https://web.archive.org/web/20230213154832/http://download.ahnlab.com/global/brochure/%5BAnalysis%5DAndariel_Group.pdf"}]},{"technique_id":"T1189","description":"Andariel has used watering hole attacks, often with zero-day exploits, to gain initial access to victims within a specific IP range.","sources":[{"source":"AhnLab Andariel Subgroup of Lazarus June 2018","url":"https://web.archive.org/web/20230213154832/http://download.ahnlab.com/global/brochure/%5BAnalysis%5DAndariel_Group.pdf"},{"source":"TrendMicro New Andariel Tactics July 2018","url":"https://www.trendmicro.com/en_us/research/18/g/new-andariel-reconnaissance-tactics-hint-at-next-targets.html"}]},{"technique_id":"T1203","description":"Andariel has exploited numerous ActiveX vulnerabilities, including zero-days.","sources":[{"source":"TrendMicro New Andariel Tactics July 2018","url":"https://www.trendmicro.com/en_us/research/18/g/new-andariel-reconnaissance-tactics-hint-at-next-targets.html"},{"source":"FSI Andariel Campaign Rifle July 2017","url":"https://fsiceat.tistory.com/2"}]},{"technique_id":"T1204.002","description":"Andariel has attempted to lure victims into enabling malicious macros within email attachments.","sources":[{"source":"AhnLab Andariel Subgroup of Lazarus June 2018","url":"https://web.archive.org/web/20230213154832/http://download.ahnlab.com/global/brochure/%5BAnalysis%5DAndariel_Group.pdf"}]},{"technique_id":"T1566.001","description":"Andariel has conducted spearphishing campaigns that included malicious Word or Excel attachments.","sources":[{"source":"AhnLab Andariel Subgroup of Lazarus June 2018","url":"https://web.archive.org/web/20230213154832/http://download.ahnlab.com/global/brochure/%5BAnalysis%5DAndariel_Group.pdf"},{"source":"MalwareBytes Lazarus-Andariel Conceals Code April 2021","url":"https://blog.malwarebytes.com/threat-intelligence/2021/04/lazarus-apt-conceals-malicious-code-within-bmp-file-to-drop-its-rat/"}]},{"technique_id":"T1588.001","description":"Andariel has used a variety of publicly-available remote access Trojans (RATs) for its operations.","sources":[{"source":"FSI Andariel Campaign Rifle July 2017","url":"https://fsiceat.tistory.com/2"}]},{"technique_id":"T1590.005","description":"Andariel has limited its watering hole attacks to specific IP address ranges.","sources":[{"source":"AhnLab Andariel Subgroup of Lazarus June 2018","url":"https://web.archive.org/web/20230213154832/http://download.ahnlab.com/global/brochure/%5BAnalysis%5DAndariel_Group.pdf"}]},{"technique_id":"T1592.002","description":"Andariel has inserted a malicious script within compromised websites to collect potential victim information such as browser type, system language, Flash Player version, and other data.","sources":[{"source":"TrendMicro New Andariel Tactics July 2018","url":"https://www.trendmicro.com/en_us/research/18/g/new-andariel-reconnaissance-tactics-hint-at-next-targets.html"}]}]},{"id":"G1007","name":"Aoqin Dragon","procedures":[{"technique_id":"T1027.002","description":"Aoqin Dragon has used the Themida packer to obfuscate malicious payloads.","sources":[{"source":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"technique_id":"T1036","description":"Aoqin Dragon has used fake icons including antivirus and external drives to disguise malicious payloads.","sources":[{"source":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"technique_id":"T1083","description":"Aoqin Dragon has run scripts to identify file formats including Microsoft Word.","sources":[{"source":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"technique_id":"T1091","description":"Aoqin Dragon has used a dropper that employs a worm infection strategy using a removable device to breach a secure network environment.","sources":[{"source":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"technique_id":"T1203","description":"Aoqin Dragon has exploited CVE-2012-0158 and CVE-2010-3333 for execution against targeted systems.","sources":[{"source":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"technique_id":"T1204.002","description":"Aoqin Dragon has lured victims into opening weaponized documents, fake external drives, and fake antivirus to execute malicious payloads.","sources":[{"source":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"technique_id":"T1570","description":"Aoqin Dragon has spread malware in target networks by copying modules to folders masquerading as removable devices.","sources":[{"source":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"technique_id":"T1587.001","description":"Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.","sources":[{"source":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]},{"technique_id":"T1588.002","description":"Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.","sources":[{"source":"SentinelOne Aoqin Dragon June 2022","url":"https://www.sentinelone.com/labs/aoqin-dragon-newly-discovered-chinese-linked-apt-has-been-quietly-spying-on-organizations-for-10-years/"}]}]},{"id":"G1049","name":"AppleJeus","procedures":[{"technique_id":"T1566","description":"AppleJeus has used spearphishing emails to distribute malicious payloads.","sources":[{"source":"dtex DPRK 2025 structure ITworkers","url":"https://reports.dtexsystems.com/DTEX-Exposing+DPRK+Cyber+Syndicate+and+Hidden+IT+Workforce.pdf"}]},{"technique_id":"T1657","description":"AppleJeus has targeted the cryptocurrency industry with the goal of stealing digital assets.","sources":[{"source":"Mandiant DPRK Groups 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/north-korea-cyber-structure-alignment-2023"}]}]},{"id":"G1028","name":"APT-C-23","procedures":[]},{"id":"G0099","name":"APT-C-36","procedures":[{"technique_id":"T1027","description":"APT-C-36 has used ConfuserEx to obfuscate its variant of Imminent Monitor, compressed payloads and RAT packages, and password protected encrypted email attachments to avoid detection. APT-C-36 has also compressed initial droppers into ZIP, LHA and UUE formats.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"technique_id":"T1027.003","description":"APT-C-36 has used steganography to hide malicious code, typically in the resource section of executable files.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"},{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"technique_id":"T1027.013","description":"APT-C-36 has used encoded and obfuscated files, images, and executables.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"}]},{"technique_id":"T1027.016","description":"APT-C-36 has used junk characters to obfuscate malicious scripts.","sources":[{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"}]},{"technique_id":"T1036.004","description":"APT-C-36 has disguised its scheduled tasks as those used by Google.","sources":[{"source":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"technique_id":"T1036.005","description":"APT-C-36 has disguised malicious executables to appear as legitimate files.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"}]},{"technique_id":"T1047","description":"APT-C-36 has used WMI to execute PowerShell.","sources":[{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"technique_id":"T1053.005","description":"APT-C-36 has used a macro function to set scheduled tasks, disguised as those used by Google.","sources":[{"source":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"technique_id":"T1055.012","description":"APT-C-36 has used process hollowing to execute malware in the memory of legitimate processes.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"}]},{"technique_id":"T1059.001","description":"APT-C-36 has used PowerShell in malware execution including as part of fileless attack chains to download additional payloads.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"technique_id":"T1059.005","description":"APT-C-36 has used VBScript for initial malware deployment including within a malicious Word document which is executed upon the document opening.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"LevelBlue Blind Eagle Proton66 JUN 2025","url":"https://www.levelblue.com/blogs/spiderlabs-blog/tracing-blind-eagle-to-proton66/"},{"source":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"technique_id":"T1059.007","description":"APT-C-36 has used a fileless attack chain composed of three JavaScript code snippets to execute subsequent payloads.","sources":[{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"technique_id":"T1105","description":"APT-C-36 has downloaded binary data from a specified domain after the malicious document is opened.","sources":[{"source":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"technique_id":"T1133","description":"APT-C-36 has used VPNs in their operational infrastructure.","sources":[{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"}]},{"technique_id":"T1204.001","description":"APT-C-36 has used malicious links in emails, often impersonating official notifications and documents, to direct users to execute malicious payloads.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"}]},{"technique_id":"T1204.002","description":"APT-C-36 has prompted victims to open attachments and to accept macros in order to execute the subsequent payload. APT-C-36 has also lured victims into opening malicious files hosted on Google Drive that triggered WebDAV requests to download malware.","sources":[{"source":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"},{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"},{"source":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"technique_id":"T1480","description":"APT-C-36 has used geolocation filtering in malware delivery to redirect traffic not coming from a targeted region or country, such as Ecuador or Colombia, to legitimate sites.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"}]},{"technique_id":"T1534","description":"APT-C-36 has used a compromised account to send a phishing email to an address likely used and monitored by the IT team within the same targeted organization.","sources":[{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"technique_id":"T1564.003","description":"APT-C-36 has set the ShowWindow property of the Win32_ProcessStartup object to zero to hide PowerShell execution.","sources":[{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"technique_id":"T1566.001","description":"APT-C-36 has used spearphishing emails with malicious .pdf and .docx files and password protected RAR attachments to avoid being detected by the email gateway.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"},{"source":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"technique_id":"T1566.002","description":"APT-C-36 has sent emails containing a link that appear to lead to an urgent notification from a government institution, at times using URL shorteners like cort[.]as, acortaurl[.]com, and gtly[.]to.","sources":[{"source":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"}]},{"technique_id":"T1568","description":"APT-C-36 has used DDNS services such as DuckDNS, noip[.]com, and con-ip[.]com to redirect victims to sites or repositories hosting malware implants.","sources":[{"source":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"},{"source":"LevelBlue Blind Eagle Proton66 JUN 2025","url":"https://www.levelblue.com/blogs/spiderlabs-blog/tracing-blind-eagle-to-proton66/"},{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"technique_id":"T1571","description":"APT-C-36 has used port 4050 for C2 communications.","sources":[{"source":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"technique_id":"T1574.001","description":"APT-C-36 has used side-loading to execute the HijackLoader payload.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"}]},{"technique_id":"T1583.001","description":"APT-C-36 has acquired domains to host malicious payloads.","sources":[{"source":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"},{"source":"LevelBlue Blind Eagle Proton66 JUN 2025","url":"https://www.levelblue.com/blogs/spiderlabs-blog/tracing-blind-eagle-to-proton66/"},{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"technique_id":"T1583.003","description":"APT-C-36 has incorporated virtual private servers (VPS) into its operational infrastructure.","sources":[{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"}]},{"technique_id":"T1583.006","description":"APT-C-36 campaign architecture has included image hosting sites, Pastebin, Discord, GitHub, Google Drive, BitBucket, and Dropbox.","sources":[{"source":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"},{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"technique_id":"T1584.005","description":"APT-C-36 has used a botnet management interface to control large numbers of compromised hosts.","sources":[{"source":"LevelBlue Blind Eagle Proton66 JUN 2025","url":"https://www.levelblue.com/blogs/spiderlabs-blog/tracing-blind-eagle-to-proton66/"}]},{"technique_id":"T1586.002","description":"APT-C-36 has regularly used compromised email accounts in spearphishing campaigns.","sources":[{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"},{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]},{"technique_id":"T1586.003","description":"APT-C-36 has used compromised Google Drive accounts including one associated with a Colombian government organization.","sources":[{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"}]},{"technique_id":"T1587.001","description":"APT-C-36 has customized existing malware with new capabilities including njRAT, AsyncRAT, LimeRAT, and BitRAT.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"}]},{"technique_id":"T1588.001","description":"APT-C-36 has utilized well known malware including the Packer-as-a-Service HeartCrypt, PureCrypter, and open-source RATs such as Remcos.","sources":[{"source":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"},{"source":"LevelBlue Blind Eagle Proton66 JUN 2025","url":"https://www.levelblue.com/blogs/spiderlabs-blog/tracing-blind-eagle-to-proton66/"}]},{"technique_id":"T1588.002","description":"APT-C-36 utilizes tools well known in crime communities and has obtained and used a modified variant of Imminent Monitor.","sources":[{"source":"Check Point Blind Eagle MAR 2025","url":"https://research.checkpoint.com/2025/blind-eagle-and-justice-for-all/"},{"source":"QiAnXin APT-C-36 Feb2019","url":"https://web.archive.org/web/20190625182633if_/https://ti.360.net/blog/articles/apt-c-36-continuous-attacks-targeting-colombian-government-institutions-and-corporations-en/"}]},{"technique_id":"T1593","description":"APT-C-36 has gathered information on Colombian financial institutions, including Bancolombia, BBVA, Banco Caja Social, and Davivienda to craft phishing pages.","sources":[{"source":"LevelBlue Blind Eagle Proton66 JUN 2025","url":"https://www.levelblue.com/blogs/spiderlabs-blog/tracing-blind-eagle-to-proton66/"}]},{"technique_id":"T1608.001","description":"APT-C-36 has staged malware implants on group-owned repositories and sites.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"LevelBlue Blind Eagle Proton66 JUN 2025","url":"https://www.levelblue.com/blogs/spiderlabs-blog/tracing-blind-eagle-to-proton66/"}]},{"technique_id":"T1683.001","description":"APT-C-36 has generated email content impersonating official notifications and documents that direct victims to execute malicious payloads.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"}]},{"technique_id":"T1683.002","description":"APT-C-36 has used phishing pages appearing like legitimate banking login portals to compromise credentials.","sources":[{"source":"LevelBlue Blind Eagle Proton66 JUN 2025","url":"https://www.levelblue.com/blogs/spiderlabs-blog/tracing-blind-eagle-to-proton66/"}]},{"technique_id":"T1684.001","description":"APT-C-36 has impersonated banks including Banco Davivienda, Bancolombia, and BBVA as well as government institutions such as Colombia’s National Directorate of Taxes and Customs, Ministry of Foreign Affairs, and Office of the Attorney General.","sources":[{"source":"Kaspersky BlindEagle AUG 2024","url":"https://securelist.com/blindeagle-apt/113414/"},{"source":"Recorded Future TAG-144 AUG 2025","url":"https://assets.recordedfuture.com/insikt-report-pdfs/2025/cta-2025-0826.pdf"},{"source":"LevelBlue Blind Eagle Proton66 JUN 2025","url":"https://www.levelblue.com/blogs/spiderlabs-blog/tracing-blind-eagle-to-proton66/"},{"source":"Zscaler BlindEagle DEC 2025","url":"https://www.zscaler.com/blogs/security-research/blindeagle-targets-colombian-government-agency-caminho-and-dcrat"}]}]},{"id":"G0006","name":"APT1","procedures":[{"technique_id":"T1003.001","description":"APT1 has been known to use credential dumping using Mimikatz.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1005","description":"APT1 has collected files from a local victim.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1007","description":"APT1 used the commands net start and tasklist to get a listing of the services on the system.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1016","description":"APT1 used the ipconfig /all command to gather network configuration information.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1021.001","description":"The APT1 group is known to have used RDP during operations.","sources":[{"source":"FireEye PLA","url":"https://web.archive.org/web/20210417085454/https://www.fireeye.com/blog/threat-research/2014/05/the-pla-and-the-800am-500pm-work-day-fireeye-confirms-dojs-findings-on-apt1-intrusion-activity.html"}]},{"technique_id":"T1036.005","description":"The file name AcroRD32.exe, a legitimate process name for Adobe's Acrobat Reader, was used by APT1 as a name for malware.","sources":[{"source":"Mandiant APT1 Appendix","url":"https://www.mandiant.com/sites/default/files/2021-09/mandiant-apt1-report.pdf"},{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1049","description":"APT1 used the net use command to get a listing on network connections.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1057","description":"APT1 gathered a list of running processes on the system using tasklist /v.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1059.003","description":"APT1 has used the Windows command shell to execute commands, and batch scripting to automate execution.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1087.001","description":"APT1 used the commands net localgroup,net user, and net group to find accounts on the system.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1114.001","description":"APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. GETMAIL extracts emails from archived Outlook .pst files.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1114.002","description":"APT1 uses two utilities, GETMAIL and MAPIGET, to steal email. MAPIGET steals email still on Exchange servers that has not yet been archived.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1119","description":"APT1 used a batch script to perform a series of discovery techniques and saves it to a text file.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1135","description":"APT1 listed connected network shares.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1550.002","description":"The APT1 group is known to have used pass the hash.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1560.001","description":"APT1 has used RAR to compress files before moving them outside of the victim network.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1566.001","description":"APT1 has sent spearphishing emails containing malicious attachments.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1566.002","description":"APT1 has sent spearphishing emails containing hyperlinks to malicious files.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1583.001","description":"APT1 has registered hundreds of domains for use in operations.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1584.001","description":"APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1585.002","description":"APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1588.001","description":"APT1 used publicly available malware for privilege escalation.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]},{"technique_id":"T1588.002","description":"APT1 has used various open-source tools for privilege escalation purposes.","sources":[{"source":"Mandiant APT1","url":"https://www.fireeye.com/content/dam/fireeye-www/services/pdfs/mandiant-apt1-report.pdf"}]}]},{"id":"G0005","name":"APT12","procedures":[{"technique_id":"T1102.002","description":"APT12 has used blogs and WordPress for C2 infrastructure.","sources":[]},{"technique_id":"T1203","description":"APT12 has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities (CVE-2009-3129, CVE-2012-0158) and vulnerabilities in Adobe Reader and Flash (CVE-2009-4324, CVE-2009-0927, CVE-2011-0609, CVE-2011-0611).","sources":[{"source":"Moran 2014","url":"https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html"},{"source":"Trend Micro IXESHE 2012","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}]},{"technique_id":"T1204.002","description":"APT12 has attempted to get victims to open malicious Microsoft Word and PDF attachment sent via spearphishing.","sources":[{"source":"Moran 2014","url":"https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html"},{"source":"Trend Micro IXESHE 2012","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}]},{"technique_id":"T1566.001","description":"APT12 has sent emails with malicious Microsoft Office documents and PDFs attached.","sources":[{"source":"Moran 2014","url":"https://www.fireeye.com/blog/threat-research/2014/09/darwins-favorite-apt-group-2.html"},{"source":"Trend Micro IXESHE 2012","url":"https://www.trendmicro.de/cloud-content/us/pdfs/security-intelligence/white-papers/wp_ixeshe.pdf"}]},{"technique_id":"T1568.003","description":"APT12 has used multiple variants of DNS Calculation including multiplying the first two octets of an IP address and adding the third octet to that value in order to get a resulting command and control port.","sources":[]}]},{"id":"G0023","name":"APT16","procedures":[{"technique_id":"T1584.004","description":"APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.","sources":[{"source":"FireEye EPS Awakens Part 2","url":"https://web.archive.org/web/20151226205946/https://www.fireeye.com/blog/threat-research/2015/12/the-eps-awakens-part-two.html"}]}]},{"id":"G0025","name":"APT17","procedures":[{"technique_id":"T1583.006","description":"APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.","sources":[{"source":"FireEye APT17","url":"https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf"}]},{"technique_id":"T1585","description":"APT17 has created and cultivated profile pages in Microsoft TechNet. To make profile pages appear more legitimate, APT17 has created biographical sections and posted in forum threads.","sources":[{"source":"FireEye APT17","url":"https://web.archive.org/web/20240119213200/https://www2.fireeye.com/rs/fireye/images/APT17_Report.pdf"}]}]},{"id":"G0026","name":"APT18","procedures":[{"technique_id":"T1027.013","description":"APT18 obfuscates strings in the payload.","sources":[{"source":"PaloAlto DNS Requests May 2016","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]},{"technique_id":"T1053.002","description":"APT18 actors used the native at Windows task scheduler tool to use scheduled tasks for execution on a victim network.","sources":[]},{"technique_id":"T1059.003","description":"APT18 uses cmd.exe to execute commands on the victim’s machine.","sources":[{"source":"PaloAlto DNS Requests May 2016","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"},{"source":"Anomali Evasive Maneuvers July 2015","url":"https://www.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop"}]},{"technique_id":"T1070.004","description":"APT18 actors deleted tools and batch files from victim systems.","sources":[]},{"technique_id":"T1071.001","description":"APT18 uses HTTP for C2 communications.","sources":[{"source":"PaloAlto DNS Requests May 2016","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]},{"technique_id":"T1071.004","description":"APT18 uses DNS for C2 communications.","sources":[{"source":"PaloAlto DNS Requests May 2016","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]},{"technique_id":"T1078","description":"APT18 actors leverage legitimate credentials to log into external remote services.","sources":[{"source":"RSA2017 Detect and Respond Adair","url":"https://web.archive.org/web/20210803040540/https://published-prd.lanyonevents.com/published/rsaus17/sessionsFiles/5009/HTA-F02-Detecting-and-Responding-to-Advanced-Threats-within-Exchange-Environments.pdf"}]},{"technique_id":"T1082","description":"APT18 can collect system information from the victim’s machine.","sources":[{"source":"PaloAlto DNS Requests May 2016","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]},{"technique_id":"T1083","description":"APT18 can list files information for specific directories.","sources":[{"source":"PaloAlto DNS Requests May 2016","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]},{"technique_id":"T1105","description":"APT18 can upload a file to the victim’s machine.","sources":[{"source":"PaloAlto DNS Requests May 2016","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]},{"technique_id":"T1133","description":"APT18 actors leverage legitimate credentials to log into external remote services.","sources":[{"source":"RSA2017 Detect and Respond Adair","url":"https://web.archive.org/web/20210803040540/https://published-prd.lanyonevents.com/published/rsaus17/sessionsFiles/5009/HTA-F02-Detecting-and-Responding-to-Advanced-Threats-within-Exchange-Environments.pdf"}]},{"technique_id":"T1547.001","description":"APT18 establishes persistence via the HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run key.","sources":[{"source":"Anomali Evasive Maneuvers July 2015","url":"https://www.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop"},{"source":"PaloAlto DNS Requests May 2016","url":"https://researchcenter.paloaltonetworks.com/2016/05/unit42-new-wekby-attacks-use-dns-requests-as-command-and-control-mechanism/"}]}]},{"id":"G0073","name":"APT19","procedures":[{"technique_id":"T1016","description":"APT19 used an HTTP malware variant and a Port 22 malware variant to collect the MAC address and IP address from the victim’s machine.","sources":[{"source":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"technique_id":"T1027.010","description":"APT19 used Base64 to obfuscate executed commands.","sources":[{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}]},{"technique_id":"T1027.013","description":"APT19 used Base64 to obfuscate payloads.","sources":[{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}]},{"technique_id":"T1033","description":"APT19 used an HTTP malware variant and a Port 22 malware variant to collect the victim’s username.","sources":[{"source":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"technique_id":"T1059","description":"APT19 downloaded and launched code within a SCT file.","sources":[{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}]},{"technique_id":"T1059.001","description":"APT19 used PowerShell commands to execute payloads.","sources":[{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}]},{"technique_id":"T1071.001","description":"APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.","sources":[{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"},{"source":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"technique_id":"T1082","description":"APT19 collected system architecture information. APT19 used an HTTP malware variant and a Port 22 malware variant to gather the hostname and CPU information from the victim’s machine.","sources":[{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"},{"source":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"technique_id":"T1112","description":"APT19 uses a Port 22 malware variant to modify several Registry keys.","sources":[{"source":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"technique_id":"T1132.001","description":"An APT19 HTTP malware variant used Base64 to encode communications to the C2 server.","sources":[{"source":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"technique_id":"T1140","description":"An APT19 HTTP malware variant decrypts strings using single-byte XOR keys.","sources":[{"source":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"technique_id":"T1189","description":"APT19 performed a watering hole attack on forbes.com in 2014 to compromise targets.","sources":[{"source":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"technique_id":"T1204.002","description":"APT19 attempted to get users to launch malicious attachments delivered via spearphishing emails.","sources":[{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}]},{"technique_id":"T1218.010","description":"APT19 used Regsvr32 to bypass application control techniques.","sources":[{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}]},{"technique_id":"T1218.011","description":"APT19 configured its payload to inject into the rundll32.exe.","sources":[{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}]},{"technique_id":"T1543.003","description":"An APT19 Port 22 malware variant registers itself as a service.","sources":[{"source":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"technique_id":"T1547.001","description":"An APT19 HTTP malware variant establishes persistence by setting the Registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\Windows Debug Tools-%LOCALAPPDATA%\\.","sources":[{"source":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"technique_id":"T1564.003","description":"APT19 used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.","sources":[{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}]},{"technique_id":"T1566.001","description":"APT19 sent spearphishing emails with malicious attachments in RTF and XLSM formats to deliver initial exploits.","sources":[{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}]},{"technique_id":"T1574.001","description":"APT19 launched an HTTP malware variant and a Port 22 malware variant using a legitimate executable that loaded the malicious DLL.","sources":[{"source":"Unit 42 C0d0so0 Jan 2016","url":"https://researchcenter.paloaltonetworks.com/2016/01/new-attacks-linked-to-c0d0s0-group/"}]},{"technique_id":"T1588.002","description":"APT19 has obtained and used publicly-available tools like Empire.","sources":[{"source":"NCSC Joint Report Public Tools","url":"https://www.ncsc.gov.uk/report/joint-report-on-publicly-available-hacking-tools"},{"source":"FireEye APT19","url":"https://www.fireeye.com/blog/threat-research/2017/06/phished-at-the-request-of-counsel.html"}]}]},{"id":"G0007","name":"APT28","procedures":[{"technique_id":"T1001.001","description":"APT28 added \"junk data\" to each encoded string, preventing trivial decoding without knowledge of the junk removal algorithm. Each implant was given a \"junk length\" value when created, tracked by the controller software to allow seamless communication but prevent analysis of the command protocol on the wire.","sources":[{"source":"FireEye APT28","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"}]},{"technique_id":"T1003","description":"APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims.","sources":[{"source":"US District Court Indictment GRU Oct 2018","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"technique_id":"T1003.001","description":"APT28 regularly deploys both publicly available (ex: Mimikatz) and custom password retrieval tools on victims. They have also dumped the LSASS process memory using the MiniDump function.","sources":[{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1003.003","description":"APT28 has used the ntdsutil.exe utility to export the Active Directory database for credential access.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1005","description":"APT28 has retrieved internal documents from machines inside victim environments, including by using Forfiles to stage documents before exfiltration.","sources":[{"source":"Überwachung APT28 Forfiles June 2015","url":"https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/"},{"source":"TrendMicro Pawn Storm 2019","url":"https://documents.trendmicro.com/assets/white_papers/wp-pawn-storm-in-2019.pdf"},{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1014","description":"APT28 has used a UEFI (Unified Extensible Firmware Interface) rootkit known as LoJax.","sources":[{"source":"Symantec APT28 Oct 2018","url":"https://www.symantec.com/blogs/election-security/apt28-espionage-military-government"},{"source":"ESET LoJax Sept 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/09/ESET-LoJax.pdf"}]},{"technique_id":"T1021.002","description":"APT28 has mapped network drives using Net and administrator credentials.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1025","description":"An APT28 backdoor may collect the entire contents of an inserted USB device.","sources":[]},{"technique_id":"T1027.013","description":"APT28 encrypted a .dll payload using RTL and a custom encryption algorithm. APT28 has also obfuscated payloads with base64, XOR, and RC4.","sources":[{"source":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source":"Bitdefender APT28 Dec 2015","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"},{"source":"Unit 42 Sofacy Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"},{"source":"Palo Alto Sofacy 06-2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"},{"source":"Talos Seduploader Oct 2017","url":"https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"}]},{"technique_id":"T1030","description":"APT28 has split archived exfiltration files into chunks smaller than 1MB.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1036","description":"APT28 has renamed the WinRAR utility to avoid detection.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1036.005","description":"APT28 has changed extensions on files containing exfiltrated data to make them appear benign, and renamed a web shell instance to appear as a legitimate OWA page.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1037.001","description":"An APT28 loader Trojan adds the Registry key HKCU\\Environment\\UserInitMprLogonScript to establish persistence.","sources":[{"source":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"technique_id":"T1039","description":"APT28 has collected files from network shared drives.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1040","description":"APT28 deployed the open source tool Responder to conduct NetBIOS Name Service poisoning, which captured usernames and hashed passwords that allowed access to legitimate credentials. APT28 close-access teams have used Wi-Fi pineapples to intercept Wi-Fi signals and user credentials.","sources":[{"source":"US District Court Indictment GRU Oct 2018","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source":"FireEye APT28","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"},{"source":"FireEye APT28 Hospitality Aug 2017","url":"https://web.archive.org/web/20171202185937/https://www.fireeye.com/blog/threat-research/2017/08/apt28-targets-hospitality-sector.html"}]},{"technique_id":"T1048.002","description":"APT28 has exfiltrated archives of collected data previously staged on a target's OWA server via HTTPS.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1056.001","description":"APT28 has used tools to perform keylogging.","sources":[{"source":"TrendMicro Pawn Storm Dec 2020","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"},{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"technique_id":"T1057","description":"An APT28 loader Trojan will enumerate the victim's processes searching for explorer.exe if its current process does not have necessary permissions.","sources":[{"source":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"technique_id":"T1059.001","description":"APT28 downloads and executes PowerShell scripts and performs PowerShell commands.","sources":[{"source":"Palo Alto Sofacy 06-2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"},{"source":"TrendMicro Pawn Storm Dec 2020","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1059.003","description":"An APT28 loader Trojan uses a cmd.exe and batch script to run its payload. The group has also used macros to execute payloads.","sources":[{"source":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source":"Unit42 Cannon Nov 2018","url":"https://researchcenter.paloaltonetworks.com/2018/11/unit42-sofacy-continues-global-attacks-wheels-new-cannon-trojan/"},{"source":"TrendMicro Pawn Storm Dec 2020","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"},{"source":"Talos Seduploader Oct 2017","url":"https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"},{"source":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"technique_id":"T1068","description":"APT28 has exploited CVE-2014-4076, CVE-2015-2387, CVE-2015-1701, CVE-2017-0263, and CVE-2022-38028 to escalate privileges.","sources":[{"source":"Bitdefender APT28 Dec 2015","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"},{"source":"Securelist Sofacy Feb 2018","url":"https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"},{"source":"Nearest Neighbor Volexity","url":"https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"}]},{"technique_id":"T1070.004","description":"APT28 has intentionally deleted computer files to cover their tracks, including with use of the program CCleaner.","sources":[{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"technique_id":"T1070.006","description":"APT28 has performed timestomping on victim files.","sources":[{"source":"Crowdstrike DNC June 2016","url":"https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"}]},{"technique_id":"T1071.001","description":"Later implants used by APT28, such as CHOPSTICK, use a blend of HTTP, HTTPS, and other legitimate channels for C2, depending on module configuration.","sources":[{"source":"FireEye APT28","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1071.003","description":"APT28 has used IMAP, POP3, and SMTP for a communication channel in various implants, including using self-registered Google Mail accounts and later compromised email servers of its victims.","sources":[{"source":"FireEye APT28","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1074.001","description":"APT28 has stored captured credential information in a file named pi.log.","sources":[]},{"technique_id":"T1074.002","description":"APT28 has staged archives of collected data on a target's Outlook Web Access (OWA) server.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1078","description":"APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder.","sources":[{"source":"Trend Micro Pawn Storm April 2017","url":"https://documents.trendmicro.com/assets/wp/wp-two-years-of-pawn-storm.pdf"},{"source":"Microsoft STRONTIUM Aug 2019","url":"https://msrc-blog.microsoft.com/2019/08/05/corporate-iot-a-path-to-intrusion/"},{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1078.004","description":"APT28 has used compromised Office 365 service accounts with Global Administrator privileges to collect email from user inboxes.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1083","description":"APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.","sources":[{"source":"Überwachung APT28 Forfiles June 2015","url":"https://netzpolitik.org/2015/digital-attack-on-german-parliament-investigative-report-on-the-hack-of-the-left-party-infrastructure-in-bundestag/"},{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"technique_id":"T1090.002","description":"APT28 used other victims as proxies to relay command traffic, for instance using a compromised Georgian military email server as a hop point to NATO victims. The group has also used a tool that acts as a proxy to allow C2 even if the victim is behind a router. APT28 has also used a machine to relay and obscure communications between CHOPSTICK and their server.","sources":[{"source":"Bitdefender APT28 Dec 2015","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"},{"source":"FireEye APT28","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"},{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"technique_id":"T1090.003","description":"APT28 has routed traffic over Tor and VPN servers to obfuscate their activities.","sources":[{"source":"TrendMicro Pawn Storm Dec 2020","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"}]},{"technique_id":"T1091","description":"APT28 uses a tool to infect connected USB devices and transmit itself to air-gapped computers when the infected USB device is inserted.","sources":[]},{"technique_id":"T1092","description":"APT28 uses a tool that captures information from air-gapped computers via an infected USB and transfers it to network-connected computer when the USB is inserted.","sources":[]},{"technique_id":"T1098.002","description":"APT28 has used a Powershell cmdlet to grant the ApplicationImpersonation role to a compromised account.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1102.002","description":"APT28 has used Google Drive for C2.","sources":[{"source":"TrendMicro Pawn Storm Dec 2020","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"}]},{"technique_id":"T1105","description":"APT28 has downloaded additional files, including by using a first-stage downloader to contact the C2 server to obtain the second-stage implant.","sources":[{"source":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source":"Bitdefender APT28 Dec 2015","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"},{"source":"TrendMicro Pawn Storm Dec 2020","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"},{"source":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"technique_id":"T1110","description":"APT28 can perform brute force attacks to obtain credentials.","sources":[{"source":"TrendMicro Pawn Storm 2019","url":"https://documents.trendmicro.com/assets/white_papers/wp-pawn-storm-in-2019.pdf"},{"source":"TrendMicro Pawn Storm Dec 2020","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"},{"source":"Microsoft Targeting Elections September 2020","url":"https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/"}]},{"technique_id":"T1110.001","description":"APT28 has used a brute-force/password-spray tooling that operated in two modes: in brute-force mode it typically sent over 300 authentication attempts per hour per targeted account over the course of several hours or days. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password guessing attacks.","sources":[{"source":"Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020","url":"https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1110.003","description":"APT28 has used a brute-force/password-spray tooling that operated in two modes: in password-spraying mode it conducted approximately four authentication attempts per hour per targeted account over the course of several days or weeks. APT28 has also used a Kubernetes cluster to conduct distributed, large-scale password spray attacks.","sources":[{"source":"Microsoft STRONTIUM New Patterns Cred Harvesting Sept 2020","url":"https://www.microsoft.com/security/blog/2020/09/10/strontium-detecting-new-patters-credential-harvesting/"},{"source":"Microsoft Targeting Elections September 2020","url":"https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1113","description":"APT28 has used tools to take screenshots from victims.","sources":[{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"},{"source":"XAgentOSX 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-xagentosx-sofacys-xagent-macos-tool/"},{"source":"Secureworks IRON TWILIGHT Active Measures March 2017","url":"https://www.secureworks.com/research/iron-twilight-supports-active-measures"}]},{"technique_id":"T1114.002","description":"APT28 has collected emails from victim Microsoft Exchange servers.","sources":[{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1119","description":"APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.","sources":[{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"technique_id":"T1120","description":"APT28 uses a module to receive a notification every time a USB mass storage device is inserted into a victim.","sources":[]},{"technique_id":"T1133","description":"APT28 has used Tor and a variety of commercial VPN services to route brute force authentication attempts.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1134.001","description":"APT28 has used CVE-2015-1701 to access the SYSTEM token and copy it into the current process as part of privilege escalation.","sources":[{"source":"FireEye Op RussianDoll","url":"https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html"}]},{"technique_id":"T1137.002","description":"APT28 has used the Office Test persistence mechanism within Microsoft Office by adding the Registry key HKCU\\Software\\Microsoft\\Office test\\Special\\Perf to execute code.","sources":[{"source":"Palo Alto Office Test Sofacy","url":"https://researchcenter.paloaltonetworks.com/2016/07/unit42-technical-walkthrough-office-test-persistence-method-used-in-recent-sofacy-attacks/"}]},{"technique_id":"T1140","description":"An APT28 macro uses the command certutil -decode to decode contents of a .txt file storing the base64 encoded payload.","sources":[{"source":"Unit 42 Sofacy Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"},{"source":"Palo Alto Sofacy 06-2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"}]},{"technique_id":"T1189","description":"APT28 has compromised targets via strategic web compromise utilizing custom exploit kits. APT28 used reflected cross-site scripting (XSS) against government websites to redirect users to phishing webpages.","sources":[{"source":"Leonard TAG 2023","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"},{"source":"Secureworks IRON TWILIGHT Active Measures March 2017","url":"https://www.secureworks.com/research/iron-twilight-supports-active-measures"}]},{"technique_id":"T1190","description":"APT28 has used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144, to gain execution on vulnerable Microsoft Exchange; they have also conducted SQL injection attacks against external websites.","sources":[{"source":"US District Court Indictment GRU Oct 2018","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1199","description":"Once APT28 gained access to the DCCC network, the group then proceeded to use that access to compromise the DNC network.","sources":[{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"technique_id":"T1203","description":"APT28 has exploited Microsoft Office vulnerability CVE-2017-0262 for execution.","sources":[{"source":"Securelist Sofacy Feb 2018","url":"https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"}]},{"technique_id":"T1204.001","description":"APT28 has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.","sources":[{"source":"US District Court Indictment GRU Oct 2018","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source":"Secureworks IRON TWILIGHT Active Measures March 2017","url":"https://www.secureworks.com/research/iron-twilight-supports-active-measures"}]},{"technique_id":"T1204.002","description":"APT28 attempted to get users to click on Microsoft Office attachments containing malicious macro scripts.","sources":[{"source":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source":"Unit 42 Sofacy Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"},{"source":"Secureworks IRON TWILIGHT Active Measures March 2017","url":"https://www.secureworks.com/research/iron-twilight-supports-active-measures"},{"source":"Cato LAMEHUG JUL 2025","url":"https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/"}]},{"technique_id":"T1210","description":"APT28 exploited a Windows SMB Remote Code Execution Vulnerability to conduct lateral movement.","sources":[{"source":"FireEye APT28","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"},{"source":"MS17-010 March 2017","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2017/ms17-010"},{"source":"FireEye APT28 Hospitality Aug 2017","url":"https://web.archive.org/web/20171202185937/https://www.fireeye.com/blog/threat-research/2017/08/apt28-targets-hospitality-sector.html"}]},{"technique_id":"T1211","description":"APT28 has used CVE-2015-4902 to bypass security features.","sources":[{"source":"Bitdefender APT28 Dec 2015","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"}]},{"technique_id":"T1213","description":"APT28 has collected files from various information repositories.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1213.002","description":"APT28 has collected information from Microsoft SharePoint services within target networks.","sources":[{"source":"RSAC 2015 Abu Dhabi Stefano Maccaglia","url":"https://paper.seebug.org/papers/APT/APT_CyberCriminal_Campagin/2015/2015.11.04_Evolving_Threats/cct-w08_evolving-threats-dissection-of-a-cyber-espionage-attack.pdf"}]},{"technique_id":"T1218.011","description":"APT28 executed CHOPSTICK by using rundll32 commands such as rundll32.exe “C:\\Windows\\twain_64.dll”. APT28 also executed a .dll for a first stage dropper using rundll32.exe. An APT28 loader Trojan saved a batch script that uses rundll32 to execute a DLL payload.","sources":[{"source":"Crowdstrike DNC June 2016","url":"https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"},{"source":"Bitdefender APT28 Dec 2015","url":"https://download.bitdefender.com/resources/media/materials/white-papers/en/Bitdefender_In-depth_analysis_of_APT28%E2%80%93The_Political_Cyber-Espionage.pdf"},{"source":"ESET Zebrocy May 2019","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"},{"source":"Palo Alto Sofacy 06-2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"},{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"},{"source":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"technique_id":"T1221","description":"APT28 used weaponized Microsoft Word documents abusing the remote template function to retrieve a malicious macro.","sources":[{"source":"Unit42 Sofacy Dec 2018","url":"https://unit42.paloaltonetworks.com/dear-joohn-sofacy-groups-global-campaign/"}]},{"technique_id":"T1498","description":"In 2016, APT28 conducted a distributed denial of service (DDoS) attack against the World Anti-Doping Agency.","sources":[{"source":"US District Court Indictment GRU Oct 2018","url":"https://www.justice.gov/opa/page/file/1098481/download"}]},{"technique_id":"T1505.003","description":"APT28 has used a modified and obfuscated version of the reGeorg web shell to maintain persistence on a target's Outlook Web Access (OWA) server.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1528","description":"APT28 has used several malicious applications to steal user OAuth access tokens including applications masquerading as \"Google Defender\" \"Google Email Protection,\" and \"Google Scanner\" for Gmail users. They also targeted Yahoo users with applications masquerading as \"Delivery Service\" and \"McAfee Email Protection\".","sources":[{"source":"Trend Micro Pawn Storm OAuth 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks"}]},{"technique_id":"T1542.003","description":"APT28 has deployed a bootkit along with Downdelph to ensure its persistence on the victim. The bootkit shares code with some variants of BlackEnergy.","sources":[]},{"technique_id":"T1546.015","description":"APT28 has used COM hijacking for persistence by replacing the legitimate MMDeviceEnumerator object with a payload.","sources":[{"source":"ESET Zebrocy May 2019","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"}]},{"technique_id":"T1547.001","description":"APT28 has deployed malware that has copied itself to the startup directory for persistence.","sources":[{"source":"TrendMicro Pawn Storm Dec 2020","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"}]},{"technique_id":"T1550.001","description":"APT28 has used several malicious applications that abused OAuth access tokens to gain access to target email accounts, including Gmail and Yahoo Mail.","sources":[{"source":"Trend Micro Pawn Storm OAuth 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/pawn-storm-abuses-open-authentication-advanced-social-engineering-attacks"}]},{"technique_id":"T1550.002","description":"APT28 has used pass the hash for lateral movement.","sources":[]},{"technique_id":"T1557.004","description":"APT28 has used a Wi-Fi Pineapple to set up Evil Twin Wi-Fi Poisoning for the purposes of capturing victim credentials or planting espionage-oriented malware.","sources":[{"source":"US District Court Indictment GRU Oct 2018","url":"https://www.justice.gov/opa/page/file/1098481/download"}]},{"technique_id":"T1559.002","description":"APT28 has delivered JHUHUGIT and Koadic by executing PowerShell commands through DDE in Word documents.","sources":[{"source":"McAfee APT28 DDE1 Nov 2017","url":"https://securingtomorrow.mcafee.com/mcafee-labs/apt28-threat-group-adopts-dde-technique-nyc-attack-theme-in-latest-campaign/"},{"source":"Palo Alto Sofacy 06-2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"}]},{"technique_id":"T1560","description":"APT28 used a publicly available tool to gather and compress multiple documents on the DCCC and DNC networks.","sources":[{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]},{"technique_id":"T1560.001","description":"APT28 has used a variety of utilities, including WinRAR, to archive collected data with password protection.","sources":[{"source":"Cybersecurity Advisory GRU Brute Force Campaign July 2021","url":"https://media.defense.gov/2021/Jul/01/2002753896/-1/-1/1/CSA_GRU_GLOBAL_BRUTE_FORCE_CAMPAIGN_UOO158036-21.PDF"}]},{"technique_id":"T1564.001","description":"APT28 has saved files with hidden file attributes.","sources":[{"source":"Talos Seduploader Oct 2017","url":"https://blog.talosintelligence.com/2017/10/cyber-conflict-decoy-document.html"}]},{"technique_id":"T1564.003","description":"APT28 has used the WindowStyle parameter to conceal PowerShell windows.","sources":[{"source":"Palo Alto Sofacy 06-2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"},{"source":"McAfee APT28 DDE1 Nov 2017","url":"https://securingtomorrow.mcafee.com/mcafee-labs/apt28-threat-group-adopts-dde-technique-nyc-attack-theme-in-latest-campaign/"}]},{"technique_id":"T1566.001","description":"APT28 sent spearphishing emails containing malicious Microsoft Office and RAR attachments.","sources":[{"source":"Accenture SNAKEMACKEREL Nov 2018","url":"https://www.accenture.com/t20181129T203820Z__w__/us-en/_acnmedia/PDF-90/Accenture-snakemackerel-delivers-zekapab-malware.pdf#zoom=50"},{"source":"Sofacy DealersChoice","url":"https://researchcenter.paloaltonetworks.com/2018/03/unit42-sofacy-uses-dealerschoice-target-european-government-agency/"},{"source":"TrendMicro Pawn Storm Dec 2020","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"},{"source":"Securelist Sofacy Feb 2018","url":"https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"},{"source":"Unit 42 Sofacy Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-sofacy-attacks-multiple-government-entities/"},{"source":"Palo Alto Sofacy 06-2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"},{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"},{"source":"Secureworks IRON TWILIGHT Active Measures March 2017","url":"https://www.secureworks.com/research/iron-twilight-supports-active-measures"},{"source":"Cato LAMEHUG JUL 2025","url":"https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/"}]},{"technique_id":"T1567","description":"APT28 can exfiltrate data over Google Drive.","sources":[{"source":"TrendMicro Pawn Storm Dec 2020","url":"https://www.trendmicro.com/en_us/research/20/l/pawn-storm-lack-of-sophistication-as-a-strategy.html"}]},{"technique_id":"T1573.001","description":"APT28 installed a Delphi backdoor that used a custom algorithm for C2 communications.","sources":[{"source":"ESET Zebrocy May 2019","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"}]},{"technique_id":"T1583.001","description":"APT28 registered domains imitating NATO, OSCE security websites, Caucasus information resources, and other organizations.","sources":[{"source":"US District Court Indictment GRU Oct 2018","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source":"FireEye APT28","url":"https://web.archive.org/web/20151022204649/https://www.fireeye.com/content/dam/fireeye-www/global/en/current-threats/pdfs/rpt-apt28.pdf"},{"source":"Google TAG Ukraine Threat Landscape March 2022","url":"https://blog.google/threat-analysis-group/update-threat-landscape-ukraine"}]},{"technique_id":"T1583.003","description":"APT28 hosted phishing domains on free services for brief periods of time during campaigns.","sources":[{"source":"Leonard TAG 2023","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"}]},{"technique_id":"T1583.006","description":"APT28 has used newly-created Blogspot pages for credential harvesting operations.","sources":[{"source":"Google TAG Ukraine Threat Landscape March 2022","url":"https://blog.google/threat-analysis-group/update-threat-landscape-ukraine"}]},{"technique_id":"T1584.008","description":"APT28 compromised Ubiquiti network devices to act as collection devices for credentials compromised via phishing webpages.","sources":[{"source":"Leonard TAG 2023","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"}]},{"technique_id":"T1586.002","description":"APT28 has used compromised email accounts to send credential phishing emails.","sources":[{"source":"Google TAG Ukraine Threat Landscape March 2022","url":"https://blog.google/threat-analysis-group/update-threat-landscape-ukraine"}]},{"technique_id":"T1588.002","description":"APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.","sources":[{"source":"Securelist Sofacy Feb 2018","url":"https://securelist.com/a-slice-of-2017-sofacy-activity/83930/"},{"source":"Palo Alto Sofacy 06-2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-sofacy-groups-parallel-attacks/"},{"source":"FireEye APT28 Hospitality Aug 2017","url":"https://web.archive.org/web/20171202185937/https://www.fireeye.com/blog/threat-research/2017/08/apt28-targets-hospitality-sector.html"}]},{"technique_id":"T1588.007","description":"APT28 has deployed LAMEHUG which can can query an LLM to generate and return commands for post compromise activity on targeted systems.","sources":[{"source":"Nov AI Threat Tracker","url":"https://cloud.google.com/blog/topics/threat-intelligence/threat-actor-usage-of-ai-tools"}]},{"technique_id":"T1589.001","description":"APT28 has harvested user's login credentials.","sources":[{"source":"Microsoft Targeting Elections September 2020","url":"https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/"}]},{"technique_id":"T1591","description":"APT28 has used large language models (LLMs) to gather information about satellite capabilities.","sources":[{"source":"MSFT-AI","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"},{"source":"OpenAI-CTI","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/"}]},{"technique_id":"T1595.002","description":"APT28 has performed large-scale scans in an attempt to find vulnerable servers.","sources":[{"source":"TrendMicro Pawn Storm 2019","url":"https://documents.trendmicro.com/assets/white_papers/wp-pawn-storm-in-2019.pdf"}]},{"technique_id":"T1596","description":"APT28 has used large language models (LLMs) to assist in script development and deployment.","sources":[{"source":"MSFT-AI","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"},{"source":"OpenAI-CTI","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/"}]},{"technique_id":"T1598","description":"APT28 has used spearphishing to compromise credentials.","sources":[{"source":"Microsoft Targeting Elections September 2020","url":"https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/"},{"source":"Secureworks IRON TWILIGHT Active Measures March 2017","url":"https://www.secureworks.com/research/iron-twilight-supports-active-measures"}]},{"technique_id":"T1598.003","description":"APT28 has conducted credential phishing campaigns with links that redirect to credential harvesting sites.","sources":[{"source":"US District Court Indictment GRU Oct 2018","url":"https://www.justice.gov/opa/page/file/1098481/download"},{"source":"ESET Zebrocy May 2019","url":"https://www.welivesecurity.com/2019/05/22/journey-zebrocy-land/"},{"source":"Google TAG Ukraine Threat Landscape March 2022","url":"https://blog.google/threat-analysis-group/update-threat-landscape-ukraine"},{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"},{"source":"Secureworks IRON TWILIGHT Active Measures March 2017","url":"https://www.secureworks.com/research/iron-twilight-supports-active-measures"}]},{"technique_id":"T1669","description":"APT28 has exploited open Wi-Fi access points for initial access to target devices using the network.","sources":[{"source":"Nearest Neighbor Volexity","url":"https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/"},{"source":"DOJ GRU Charges 2018","url":"https://www.justice.gov/archives/opa/pr/us-charges-russian-gru-officers-international-hacking-and-related-influence-and"}]},{"technique_id":"T1684.001","description":"LAMEHUG has sent spearphishing emails impersonating Ukrainian government officials.","sources":[{"source":"Cato LAMEHUG JUL 2025","url":"https://www.catonetworks.com/blog/cato-ctrl-threat-research-analyzing-lamehug/"}]},{"technique_id":"T1685.005","description":"APT28 has cleared event logs, including by using the commands wevtutil cl System and wevtutil cl Security.","sources":[{"source":"Crowdstrike DNC June 2016","url":"https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/"},{"source":"DOJ GRU Indictment Jul 2018","url":"https://cdn.cnn.com/cnn/2018/images/07/13/gru.indictment.pdf"}]}]},{"id":"G0016","name":"APT29","procedures":[{"technique_id":"T1003.002","description":"APT29 has used the reg save command to save registry hives.","sources":[{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1003.004","description":"APT29 has used the reg save command to extract LSA secrets offline.","sources":[{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1005","description":"APT29 has stolen data from compromised hosts.","sources":[{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1016.001","description":"APT29 has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.","sources":[{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1021.007","description":"APT29 has leveraged compromised high-privileged on-premises accounts synced to Office 365 to move laterally into a cloud environment, including through the use of Azure AD PowerShell.","sources":[{"source":"Mandiant Remediation and Hardening Strategies for Microsoft 365","url":"https://www.mandiant.com/sites/default/files/2022-08/remediation-hardening-strategies-for-m365-defend-against-apt29-white-paper.pdf"}]},{"technique_id":"T1027.001","description":"APT29 used large size files to avoid detection by security solutions with hardcoded size limits.","sources":[{"source":"SentinelOne NobleBaron June 2021","url":"https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"}]},{"technique_id":"T1027.002","description":"APT29 used UPX to pack files.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}]},{"technique_id":"T1027.006","description":"APT29 has embedded an ISO file within an HTML attachment that contained JavaScript code to initiate malware execution.","sources":[{"source":"ESET T3 Threat Report 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"}]},{"technique_id":"T1036.005","description":"APT29 has renamed malicious DLLs with legitimate names to appear benign; they have also created an Azure AD certificate with a Common Name that matched the display name of the compromised service principal.","sources":[{"source":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"},{"source":"SentinelOne NobleBaron June 2021","url":"https://labs.sentinelone.com/noblebaron-new-poisoned-installers-could-be-used-in-supply-chain-attacks/"}]},{"technique_id":"T1037","description":"APT29 has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.","sources":[{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1037.004","description":"APT29 has installed a run command on a compromised system to enable malware execution on system startup.","sources":[{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1047","description":"APT29 used WMI to steal credentials and execute backdoors at a future time.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}]},{"technique_id":"T1053.005","description":"APT29 has used named and hijacked scheduled tasks to establish persistence.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}]},{"technique_id":"T1059.001","description":"APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"},{"source":"ESET T3 Threat Report 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"},{"source":"Symantec Seaduke 2015","url":"https://web.archive.org/web/20150717011546/http://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon-duke-armory"}]},{"technique_id":"T1059.006","description":"APT29 has developed malware variants written in Python.","sources":[{"source":"Symantec Seaduke 2015","url":"https://web.archive.org/web/20150717011546/http://www.symantec.com/connect/blogs/forkmeiamfamous-seaduke-latest-weapon-duke-armory"}]},{"technique_id":"T1059.009","description":"APT29 has leveraged the Microsoft Graph API to perform various actions across Azure and M365 environments. They have also utilized AADInternals PowerShell Modules to access the API","sources":[{"source":"MSTIC Nobelium Toolset May 2021","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"technique_id":"T1068","description":"APT29 has exploited CVE-2021-36934 to escalate privileges on a compromised host.","sources":[{"source":"ESET T3 Threat Report 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"}]},{"technique_id":"T1070.004","description":"APT29 has used SDelete to remove artifacts from victim networks.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}]},{"technique_id":"T1070.006","description":"APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory.","sources":[{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1078","description":"APT29 has used a compromised account to access an organization's VPN infrastructure.","sources":[{"source":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"}]},{"technique_id":"T1078.003","description":"APT29 targets dormant or inactive user accounts, accounts belonging to individuals no longer at the organization but whose accounts remain on the system, for access and persistence.","sources":[{"source":"NCSC et al APT29 2024","url":"https://www.ic3.gov/Media/News/2024/240226.pdf"}]},{"technique_id":"T1078.004","description":"APT29 has gained access to a global administrator account in Azure AD and has used Service Principal credentials in Exchange.","sources":[{"source":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"},{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1087.004","description":"APT29 has conducted enumeration of Azure AD accounts.","sources":[{"source":"MSTIC Nobelium Oct 2021","url":"https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"}]},{"technique_id":"T1090.002","description":"APT29 uses compromised residential endpoints as proxies for defense evasion and network access.","sources":[{"source":"NCSC et al APT29 2024","url":"https://www.ic3.gov/Media/News/2024/240226.pdf"}]},{"technique_id":"T1090.003","description":"A backdoor used by APT29 created a Tor hidden service to forward traffic from the Tor client to local ports 3389 (RDP), 139 (Netbios), and 445 (SMB) enabling full remote access from outside the network and has also used TOR.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"},{"source":"MSTIC Nobelium Oct 2021","url":"https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"}]},{"technique_id":"T1090.004","description":"APT29 has used the meek domain fronting plugin for Tor to hide the destination of C2 traffic.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}]},{"technique_id":"T1098.002","description":"APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with ApplicationImpersonation rights to start collecting emails from targeted mailboxes; APT29 has also used compromised accounts holding ApplicationImpersonation rights in Exchange to collect emails.","sources":[{"source":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"},{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1098.005","description":"APT29 has enrolled their own devices into compromised cloud tenants, including enrolling a device in MFA to an Azure AD environment following a successful password guessing attack against a dormant account.","sources":[{"source":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"},{"source":"NCSC et al APT29 2024","url":"https://www.ic3.gov/Media/News/2024/240226.pdf"}]},{"technique_id":"T1105","description":"APT29 has downloaded additional tools and malware onto compromised networks.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"},{"source":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"},{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"},{"source":"PWC WellMess July 2020","url":"https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"}]},{"technique_id":"T1110.001","description":"APT29 has successfully conducted password guessing attacks against a list of mailboxes.","sources":[{"source":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"}]},{"technique_id":"T1110.003","description":"APT29 has conducted brute force password spray attacks.","sources":[{"source":"MSTIC Nobelium Oct 2021","url":"https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"},{"source":"MSRC Nobelium June 2021","url":"https://msrc-blog.microsoft.com/2021/06/25/new-nobelium-activity/"},{"source":"NCSC et al APT29 2024","url":"https://www.ic3.gov/Media/News/2024/240226.pdf"}]},{"technique_id":"T1114.002","description":"APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services (EWS) API requests.","sources":[{"source":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"},{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1133","description":"APT29 has used compromised identities to access networks via VPNs and Citrix.","sources":[{"source":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"},{"source":"NCSC APT29 July 2020","url":"https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"}]},{"technique_id":"T1136.003","description":"APT29 can create new users through Azure AD.","sources":[{"source":"MSTIC Nobelium Oct 2021","url":"https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"}]},{"technique_id":"T1190","description":"APT29 has exploited CVE-2019-19781 for Citrix, CVE-2019-11510 for Pulse Secure VPNs, CVE-2018-13379 for FortiGate VPNs, and CVE-2019-9670 in Zimbra software to gain access.","sources":[{"source":"NCSC APT29 July 2020","url":"https://www.ncsc.gov.uk/files/Advisory-APT29-targets-COVID-19-vaccine-development-V1-1.pdf"},{"source":"Cybersecurity Advisory SVR TTP May 2021","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"}]},{"technique_id":"T1199","description":"APT29 has compromised IT, cloud services, and managed services providers to gain broad access to multiple customers for subsequent operations.","sources":[{"source":"MSTIC Nobelium Oct 2021","url":"https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"}]},{"technique_id":"T1203","description":"APT29 has used multiple software exploits for common client software, like Microsoft Word, Exchange, and Adobe Reader, to gain code execution.","sources":[{"source":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"},{"source":"Cybersecurity Advisory SVR TTP May 2021","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"},{"source":"MSTIC NOBELIUM May 2021","url":"https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"}]},{"technique_id":"T1204.001","description":"APT29 has used various forms of spearphishing attempting to get a user to click on a malicious link.","sources":[{"source":"MSTIC NOBELIUM May 2021","url":"https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"},{"source":"Secureworks IRON RITUAL USAID Phish May 2021","url":"https://www.secureworks.com/blog/usaid-themed-phishing-campaign-leverages-us-elections-lure"}]},{"technique_id":"T1204.002","description":"APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files.","sources":[{"source":"ESET T3 Threat Report 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"},{"source":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"}]},{"technique_id":"T1218.005","description":"APT29 has use mshta to execute malicious scripts on a compromised host.","sources":[{"source":"ESET T3 Threat Report 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"}]},{"technique_id":"T1505.003","description":"APT29 has installed web shells on exploited Microsoft Exchange servers.","sources":[{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"},{"source":"Cybersecurity Advisory SVR TTP May 2021","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"}]},{"technique_id":"T1528","description":"APT29 uses stolen tokens to access victim accounts, without needing a password.","sources":[{"source":"NCSC et al APT29 2024","url":"https://www.ic3.gov/Media/News/2024/240226.pdf"}]},{"technique_id":"T1546.003","description":"APT29 has used WMI event subscriptions for persistence.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}]},{"technique_id":"T1546.008","description":"APT29 used sticky-keys to obtain unauthenticated, privileged console access.","sources":[{"source":"FireEye APT29 Domain Fronting","url":"https://www.fireeye.com/blog/threat-research/2017/03/apt29_domain_frontin.html"},{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}]},{"technique_id":"T1547.001","description":"APT29 added Registry Run keys to establish persistence.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}]},{"technique_id":"T1548.002","description":"APT29 has bypassed UAC.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}]},{"technique_id":"T1550.003","description":"APT29 used Kerberos ticket attacks for lateral movement.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"}]},{"technique_id":"T1553.005","description":"APT29 has embedded ISO images and VHDX files in HTML to evade Mark-of-the-Web.","sources":[{"source":"ESET T3 Threat Report 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"}]},{"technique_id":"T1556.007","description":"APT29 has edited the Microsoft.IdentityServer.Servicehost.exe.config file to load a malicious DLL into the AD FS process, thereby enabling persistent access to any service federated with AD FS for a user with a specified User Principal Name.","sources":[{"source":"MagicWeb","url":"https://www.microsoft.com/security/blog/2022/08/24/magicweb-nobeliums-post-compromise-trick-to-authenticate-as-anyone/"}]},{"technique_id":"T1566.001","description":"APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims.","sources":[{"source":"ESET T3 Threat Report 2021","url":"https://www.welivesecurity.com/wp-content/uploads/2022/02/eset_threat_report_t32021.pdf"},{"source":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"},{"source":"MSTIC NOBELIUM May 2021","url":"https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"}]},{"technique_id":"T1566.002","description":"APT29 has used spearphishing with a link to trick victims into clicking on a link to a zip file containing malicious files.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"},{"source":"MSTIC NOBELIUM May 2021","url":"https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"},{"source":"Secureworks IRON RITUAL USAID Phish May 2021","url":"https://www.secureworks.com/blog/usaid-themed-phishing-campaign-leverages-us-elections-lure"}]},{"technique_id":"T1566.003","description":"APT29 has used the legitimate mailing service Constant Contact to send phishing e-mails.","sources":[{"source":"MSTIC NOBELIUM May 2021","url":"https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"}]},{"technique_id":"T1568","description":"APT29 has used Dynamic DNS providers for their malware C2 infrastructure.","sources":[{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1573","description":"APT29 has used multiple layers of encryption within malware to protect C2 communication.","sources":[]},{"technique_id":"T1583.006","description":"APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations.","sources":[{"source":"FireEye APT29","url":"https://services.google.com/fh/files/misc/rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf"},{"source":"MSTIC NOBELIUM May 2021","url":"https://www.microsoft.com/security/blog/2021/05/27/new-sophisticated-email-based-attack-from-nobelium/"}]},{"technique_id":"T1586.002","description":"APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.","sources":[{"source":"ANSSI Nobelium Phishing December 2021","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-011.pdf"},{"source":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"}]},{"technique_id":"T1586.003","description":"APT29 has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments.","sources":[{"source":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"}]},{"technique_id":"T1587.001","description":"APT29 has used unique malware in many of their operations.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"},{"source":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"},{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"},{"source":"MSTIC Nobelium Toolset May 2021","url":"https://www.microsoft.com/security/blog/2021/05/28/breaking-down-nobeliums-latest-early-stage-toolset/"}]},{"technique_id":"T1587.003","description":"APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.","sources":[{"source":"PWC WellMess July 2020","url":"https://www.pwc.co.uk/issues/cyber-security-services/insights/cleaning-up-after-wellmess.html"},{"source":"PWC WellMess C2 August 2020","url":"https://www.pwc.co.uk/issues/cyber-security-services/insights/wellmess-analysis-command-control.html"}]},{"technique_id":"T1588.002","description":"APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.","sources":[{"source":"Mandiant No Easy Breach","url":"https://www.slideshare.net/slideshow/no-easy-breach-derby-con-2016/66447908"},{"source":"F-Secure The Dukes","url":"https://www.f-secure.com/documents/996508/1030745/dukes_whitepaper.pdf"},{"source":"Mandiant APT29 Eye Spy Email Nov 22","url":"https://www.mandiant.com/resources/blog/unc3524-eye-spy-email"}]},{"technique_id":"T1595.002","description":"APT29 has conducted widespread scanning of target environments to identify vulnerabilities for exploit.","sources":[{"source":"Cybersecurity Advisory SVR TTP May 2021","url":"https://www.ncsc.gov.uk/files/Advisory-further-TTPs-associated-with-SVR-cyber-actors.pdf"}]},{"technique_id":"T1621","description":"APT29 has used repeated MFA requests to gain access to victim accounts.","sources":[{"source":"Suspected Russian Activity Targeting Government and Business Entities Around the Globe","url":"https://www.mandiant.com/resources/russian-targeting-gov-business"},{"source":"NCSC et al APT29 2024","url":"https://www.ic3.gov/Media/News/2024/240226.pdf"}]},{"technique_id":"T1649","description":"APT29 has abused misconfigured AD CS certificate templates to impersonate admin users and create additional authentication certificates.","sources":[{"source":"Mandiant APT29 Trello","url":"https://www.mandiant.com/resources/tracking-apt29-phishing-campaigns"}]},{"technique_id":"T1651","description":"APT29 has used Azure Run Command and Azure Admin-on-Behalf-of (AOBO) to execute code on virtual machines.","sources":[{"source":"MSTIC Nobelium Oct 2021","url":"https://www.microsoft.com/security/blog/2021/10/25/nobelium-targeting-delegated-administrative-privileges-to-facilitate-broader-attacks/"}]},{"technique_id":"T1665","description":"APT29 uses compromised residential endpoints, typically within the same ISP IP address range, as proxies to hide the true source of C2 traffic.","sources":[{"source":"NCSC et al APT29 2024","url":"https://www.ic3.gov/Media/News/2024/240226.pdf"}]},{"technique_id":"T1685.002","description":"APT29 has disabled Purview Audit on targeted accounts prior to stealing emails from Microsoft 365 tenants.","sources":[{"source":"Mandiant APT29 Microsoft 365 2022","url":"https://www.mandiant.com/resources/blog/apt29-continues-targeting-microsoft"}]}]},{"id":"G0022","name":"APT3","procedures":[{"technique_id":"T1003.001","description":"APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument \"dig.\"","sources":[{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"technique_id":"T1005","description":"APT3 will identify Microsoft Office documents on the victim's computer.","sources":[]},{"technique_id":"T1016","description":"A keylogging tool used by APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.","sources":[{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"},{"source":"evolution of pirpi","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf"}]},{"technique_id":"T1018","description":"APT3 has a tool that can detect the existence of remote systems.","sources":[{"source":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"technique_id":"T1021.001","description":"APT3 enables the Remote Desktop Protocol for persistence. APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.","sources":[{"source":"Twitter Cglyer Status Update APT3 eml","url":"https://x.com/cglyer/status/985311489782374400"}]},{"technique_id":"T1021.002","description":"APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.","sources":[{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"technique_id":"T1027","description":"APT3 obfuscates files or information to help evade defensive measures.","sources":[{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"technique_id":"T1027.002","description":"APT3 has been known to pack their tools.","sources":[{"source":"APT3 Adversary Emulation Plan","url":"https://attack.mitre.org/docs/APT3_Adversary_Emulation_Plan.pdf"},{"source":"FireEye Clandestine Wolf","url":"https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"}]},{"technique_id":"T1027.005","description":"APT3 has been known to remove indicators of compromise from tools.","sources":[{"source":"APT3 Adversary Emulation Plan","url":"https://attack.mitre.org/docs/APT3_Adversary_Emulation_Plan.pdf"}]},{"technique_id":"T1033","description":"An APT3 downloader uses the Windows command \"cmd.exe\" /C whoami to verify that it is running with the elevated privileges of “System.”","sources":[{"source":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"technique_id":"T1036.010","description":"APT3 has been known to create or enable accounts, such as support_388945a0.","sources":[]},{"technique_id":"T1041","description":"APT3 has a tool that exfiltrates data over the C2 channel.","sources":[{"source":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"}]},{"technique_id":"T1049","description":"APT3 has a tool that can enumerate current network connections.","sources":[{"source":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"},{"source":"evolution of pirpi","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf"}]},{"technique_id":"T1053.005","description":"An APT3 downloader creates persistence by creating the following scheduled task: schtasks /create /tn \"mysc\" /tr C:\\Users\\Public\\test.exe /sc ONLOGON /ru \"System\".","sources":[{"source":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"technique_id":"T1056.001","description":"APT3 has used a keylogging tool that records keystrokes in encrypted files.","sources":[{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"technique_id":"T1057","description":"APT3 has a tool that can list out currently running processes.","sources":[{"source":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source":"evolution of pirpi","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf"}]},{"technique_id":"T1059.001","description":"APT3 has used PowerShell on victim systems to download and run payloads after exploitation.","sources":[{"source":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"technique_id":"T1059.003","description":"An APT3 downloader uses the Windows command \"cmd.exe\" /C whoami. The group also uses a tool to execute commands on remote computers.","sources":[{"source":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"},{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"technique_id":"T1069","description":"APT3 has a tool that can enumerate the permissions associated with Windows groups.","sources":[{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"technique_id":"T1070.004","description":"APT3 has a tool that can delete files.","sources":[{"source":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"}]},{"technique_id":"T1074.001","description":"APT3 has been known to stage files for exfiltration in a single location.","sources":[]},{"technique_id":"T1078.002","description":"APT3 leverages valid accounts after gaining credentials for use within the victim domain.","sources":[{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"technique_id":"T1082","description":"APT3 has a tool that can obtain information about the local system.","sources":[{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"},{"source":"evolution of pirpi","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf"}]},{"technique_id":"T1083","description":"APT3 has a tool that looks for files and directories on the local file system.","sources":[{"source":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source":"evolution of pirpi","url":"https://recon.cx/2017/montreal/resources/slides/RECON-MTL-2017-evolution_of_pirpi.pdf"}]},{"technique_id":"T1087.001","description":"APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.","sources":[{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"technique_id":"T1090.002","description":"An APT3 downloader establishes SOCKS5 connections for its initial C2.","sources":[{"source":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"technique_id":"T1095","description":"An APT3 downloader establishes SOCKS5 connections for its initial C2.","sources":[{"source":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"technique_id":"T1098.007","description":"APT3 has been known to add created accounts to local admin groups to maintain elevated access.","sources":[]},{"technique_id":"T1104","description":"An APT3 downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.","sources":[{"source":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"technique_id":"T1105","description":"APT3 has a tool that can copy files to remote machines.","sources":[{"source":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"}]},{"technique_id":"T1110.002","description":"APT3 has been known to brute force password hashes to be able to leverage plain text credentials.","sources":[{"source":"APT3 Adversary Emulation Plan","url":"https://attack.mitre.org/docs/APT3_Adversary_Emulation_Plan.pdf"}]},{"technique_id":"T1136.001","description":"APT3 has been known to create or enable accounts, such as support_388945a0.","sources":[]},{"technique_id":"T1203","description":"APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.","sources":[{"source":"FireEye Clandestine Wolf","url":"https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"},{"source":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"}]},{"technique_id":"T1204.001","description":"APT3 has lured victims into clicking malicious links delivered through spearphishing.","sources":[{"source":"FireEye Clandestine Wolf","url":"https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"}]},{"technique_id":"T1218.011","description":"APT3 has a tool that can run DLLs.","sources":[{"source":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"}]},{"technique_id":"T1543.003","description":"APT3 has a tool that creates a new service for persistence.","sources":[{"source":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"technique_id":"T1546.008","description":"APT3 replaces the Sticky Keys binary C:\\Windows\\System32\\sethc.exe for persistence.","sources":[]},{"technique_id":"T1547.001","description":"APT3 places scripts in the startup folder for persistence.","sources":[{"source":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"technique_id":"T1552.001","description":"APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.","sources":[{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"technique_id":"T1555.003","description":"APT3 has used tools to dump passwords from browsers.","sources":[{"source":"Symantec Buckeye","url":"https://web.archive.org/web/20160910124439/http://www.symantec.com/connect/blogs/buckeye-cyberespionage-group-shifts-gaze-us-hong-kong"}]},{"technique_id":"T1560.001","description":"APT3 has used tools to compress data before exfilling it.","sources":[]},{"technique_id":"T1564.003","description":"APT3 has been known to use -WindowStyle Hidden to conceal PowerShell windows.","sources":[{"source":"FireEye Operation Double Tap","url":"https://www.fireeye.com/blog/threat-research/2014/11/operation_doubletap.html"}]},{"technique_id":"T1566.002","description":"APT3 has sent spearphishing emails containing malicious links.","sources":[{"source":"FireEye Clandestine Wolf","url":"https://www.fireeye.com/blog/threat-research/2015/06/operation-clandestine-wolf-adobe-flash-zero-day.html"}]},{"technique_id":"T1574.001","description":"APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.","sources":[{"source":"FireEye Clandestine Fox","url":"https://www.fireeye.com/blog/threat-research/2014/04/new-zero-day-exploit-targeting-internet-explorer-versions-9-through-11-identified-in-targeted-attacks.html"},{"source":"FireEye Clandestine Fox Part 2","url":"https://www.fireeye.com/blog/threat-research/2014/06/clandestine-fox-part-deux.html"}]}]},{"id":"G0013","name":"APT30","procedures":[{"technique_id":"T1204.002","description":"APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.","sources":[{"source":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]},{"technique_id":"T1566.001","description":"APT30 has used spearphishing emails with malicious DOC attachments.","sources":[{"source":"FireEye APT30","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/05/20081935/rpt-apt30.pdf"}]}]},{"id":"G0050","name":"APT32","procedures":[{"technique_id":"T1003","description":"APT32 used GetPassword_x64 to harvest credentials.","sources":[{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1003.001","description":"APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.","sources":[{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1012","description":"APT32's backdoor can query the Windows Registry to gather system information.","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1016","description":"APT32 used the ipconfig /all command to gather the IP address from the system.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1018","description":"APT32 has enumerated DC servers using the command net group \"Domain Controllers\" /domain. The group has also used the ping command.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1021.002","description":"APT32 used Net to use Windows' hidden network shares to copy their tools to remote machines for execution.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1027.010","description":"APT32 has used the Invoke-Obfuscation framework to obfuscate their PowerShell.","sources":[{"source":"GitHub Invoke-Obfuscation","url":"https://github.com/danielbohannon/Invoke-Obfuscation"},{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1027.011","description":"APT32's backdoor has stored its configuration in a registry key.","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1027.013","description":"APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called \"Dont-Kill-My-Cat (DKMC). APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.","sources":[{"source":"GitHub Invoke-Obfuscation","url":"https://github.com/danielbohannon/Invoke-Obfuscation"},{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"},{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"},{"source":"ESET OceanLotus macOS April 2019","url":"https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"},{"source":"ESET OceanLotus","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"}]},{"technique_id":"T1027.016","description":"APT32 includes garbage code to mislead anti-malware software and researchers.","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"},{"source":"ESET OceanLotus","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"}]},{"technique_id":"T1033","description":"APT32 collected the victim's username and executed the whoami command on the victim's machine. APT32 executed shellcode to collect the username on the victim's machine.","sources":[{"source":"FireEye APT32 April 2020","url":"https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"},{"source":"ESET OceanLotus","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1036","description":"APT32 has disguised a Cobalt Strike beacon as a Flash Installer.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1036.003","description":"APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.","sources":[{"source":"Twitter ItsReallyNick APT32 pubprn Masquerade","url":"https://x.com/ItsReallyNick/status/945681177108762624"}]},{"technique_id":"T1036.004","description":"APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name. APT32 has also impersonated the legitimate Flash installer file name \"install_flashplayer.exe\".","sources":[{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"technique_id":"T1036.005","description":"APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update. APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}]},{"technique_id":"T1041","description":"APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1046","description":"APT32 performed network scanning on the network to search for open ports, services, OS finger-printing, and other vulnerabilities.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1047","description":"APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1048.003","description":"APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1049","description":"APT32 used the netstat -anpo tcp command to display TCP connections on the victim's machine.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1053.005","description":"APT32 has used scheduled tasks to persist on victim systems.","sources":[{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"},{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1055","description":"APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1056.001","description":"APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1059","description":"APT32 has used COM scriptlets to download Cobalt Strike beacons.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1059.001","description":"APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.","sources":[{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"},{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1059.003","description":"APT32 has used cmd.exe for execution.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1059.005","description":"APT32 has used macros, COM scriptlets, and VBS scripts.","sources":[{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1059.007","description":"APT32 has used JavaScript for drive-by downloads and C2 communications.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}]},{"technique_id":"T1068","description":"APT32 has used CVE-2016-7255 to escalate privileges.","sources":[{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"technique_id":"T1070.004","description":"APT32's macOS backdoor can receive a “delete” command.","sources":[{"source":"ESET OceanLotus macOS April 2019","url":"https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"}]},{"technique_id":"T1070.006","description":"APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally, APT32 has used a random value to modify the timestamp of the file storing the clientID.","sources":[{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"},{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"},{"source":"ESET OceanLotus macOS April 2019","url":"https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"}]},{"technique_id":"T1071.001","description":"APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.","sources":[{"source":"Volexity OceanLotus Nov 2017","url":"https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1071.003","description":"APT32 has used email for C2 via an Office macro.","sources":[{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1072","description":"APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.","sources":[{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"technique_id":"T1078.003","description":"APT32 has used legitimate local admin account credentials.","sources":[{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]},{"technique_id":"T1082","description":"APT32 has collected the OS version and computer name from victims. One of the group's backdoors can also query the Windows Registry to gather system information, and another macOS backdoor performs a fingerprint of the machine on its first connection to the C&C server. APT32 executed shellcode to identify the name of the infected host.","sources":[{"source":"ESET OceanLotus","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"},{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"},{"source":"ESET OceanLotus macOS April 2019","url":"https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"},{"source":"FireEye APT32 April 2020","url":"https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"}]},{"technique_id":"T1083","description":"APT32's backdoor possesses the capability to list files and directories on a machine.","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1087.001","description":"APT32 enumerated administrative users using the commands net localgroup administrators.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1102","description":"APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.","sources":[{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}]},{"technique_id":"T1105","description":"APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.","sources":[{"source":"Volexity OceanLotus Nov 2017","url":"https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/"}]},{"technique_id":"T1112","description":"APT32's backdoor has modified the Windows Registry to store the backdoor's configuration.","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1135","description":"APT32 used the net view command to show all shares available, including the administrative shares such as C$ and ADMIN$.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1137","description":"APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.","sources":[{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1189","description":"APT32 has infected victims by tricking them into visiting compromised watering hole websites.","sources":[{"source":"ESET OceanLotus","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"},{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}]},{"technique_id":"T1203","description":"APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1204.001","description":"APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"},{"source":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"}]},{"technique_id":"T1204.002","description":"APT32 has attempted to lure users to execute a malicious dropper delivered via a spearphishing attachment.","sources":[{"source":"ESET OceanLotus","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"},{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"},{"source":"FireEye APT32 April 2020","url":"https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"},{"source":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"}]},{"technique_id":"T1216.001","description":"APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.","sources":[{"source":"Twitter ItsReallyNick Status Update APT32 PubPrn","url":"https://x.com/ItsReallyNick/status/944321013084573697"}]},{"technique_id":"T1218.005","description":"APT32 has used mshta.exe for code execution.","sources":[{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1218.010","description":"APT32 created a Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"},{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1218.011","description":"APT32 malware has used rundll32.exe to execute an initial infection process.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1222.002","description":"APT32's macOS backdoor changes the permission of the file it wants to execute to 755.","sources":[{"source":"ESET OceanLotus macOS April 2019","url":"https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"}]},{"technique_id":"T1505.003","description":"APT32 has used Web shells to maintain access to victim websites.","sources":[{"source":"Volexity OceanLotus Nov 2017","url":"https://www.volexity.com/blog/2017/11/06/oceanlotus-blossoms-mass-digital-surveillance-and-exploitation-of-asean-nations-the-media-human-rights-and-civil-society/"}]},{"technique_id":"T1543.003","description":"APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence.","sources":[{"source":"ESET OceanLotus","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1547.001","description":"APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.","sources":[{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1550.002","description":"APT32 has used pass the hash for lateral movement.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1550.003","description":"APT32 successfully gained remote access by using pass the ticket.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1552.002","description":"APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.","sources":[{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1560","description":"APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1564.001","description":"APT32's macOS backdoor hides the clientID file via a chflags function.","sources":[{"source":"ESET OceanLotus macOS April 2019","url":"https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/"}]},{"technique_id":"T1564.003","description":"APT32 has used the WindowStyle parameter to conceal PowerShell windows.","sources":[{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1564.004","description":"APT32 used NTFS alternate data streams to hide their payloads.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1566.001","description":"APT32 has sent spearphishing emails with a malicious executable disguised as a document or spreadsheet.","sources":[{"source":"ESET OceanLotus","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"},{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"},{"source":"FireEye APT32 April 2020","url":"https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"},{"source":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"}]},{"technique_id":"T1566.002","description":"APT32 has sent spearphishing emails containing malicious links.","sources":[{"source":"ESET OceanLotus","url":"https://www.welivesecurity.com/2018/03/13/oceanlotus-ships-new-backdoor/"},{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"FireEye APT32 April 2020","url":"https://www.fireeye.com/blog/threat-research/2020/04/apt32-targeting-chinese-government-in-covid-19-related-espionage.html"},{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"},{"source":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"}]},{"technique_id":"T1569.002","description":"APT32's backdoor has used Windows services as a way to execute its malicious payload.","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1570","description":"APT32 has deployed tools after moving laterally using administrative accounts.","sources":[{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"}]},{"technique_id":"T1571","description":"An APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.","sources":[{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1574.001","description":"APT32 ran legitimately-signed executables from Symantec and McAfee which load a malicious DLL. The group also side-loads its backdoor by dropping a library and a legitimate, signed executable (AcroTranscoder).","sources":[{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"},{"source":"Cybereason Cobalt Kitty 2017","url":"https://cdn2.hubspot.net/hubfs/3354902/Cybereason%20Labs%20Analysis%20Operation%20Cobalt%20Kitty.pdf"},{"source":"ESET OceanLotus Mar 2019","url":"https://www.welivesecurity.com/2019/03/20/fake-or-fake-keeping-up-with-oceanlotus-decoys/"}]},{"technique_id":"T1583.001","description":"APT32 has set up and operated websites to gather information and deliver malware.","sources":[{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}]},{"technique_id":"T1583.006","description":"APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.","sources":[{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}]},{"technique_id":"T1585.001","description":"APT32 has set up Facebook pages in tandem with fake websites.","sources":[{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}]},{"technique_id":"T1588.002","description":"APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.","sources":[{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"},{"source":"Cybereason Oceanlotus May 2017","url":"https://www.cybereason.com/blog/operation-cobalt-kitty-apt"}]},{"technique_id":"T1589","description":"APT32 has conducted targeted surveillance against activists and bloggers.","sources":[{"source":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"}]},{"technique_id":"T1589.002","description":"APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.","sources":[{"source":"Amnesty Intl. Ocean Lotus February 2021","url":"https://www.amnestyusa.org/wp-content/uploads/2021/02/Click-and-Bait_Vietnamese-Human-Rights-Defenders-Targeted-with-Spyware-Attacks.pdf"}]},{"technique_id":"T1598.003","description":"APT32 has used malicious links to direct users to web pages designed to harvest credentials.","sources":[{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}]},{"technique_id":"T1608.001","description":"APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.","sources":[{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}]},{"technique_id":"T1608.004","description":"APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.","sources":[{"source":"Volexity Ocean Lotus November 2020","url":"https://www.volexity.com/blog/2020/11/06/oceanlotus-extending-cyber-espionage-operations-through-fake-websites/"}]},{"technique_id":"T1685.005","description":"APT32 has cleared select event log entries.","sources":[{"source":"FireEye APT32 May 2017","url":"https://www.fireeye.com/blog/threat-research/2017/05/cyber-espionage-apt32.html"}]}]},{"id":"G0064","name":"APT33","procedures":[{"technique_id":"T1003.001","description":"APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1003.004","description":"APT33 has used a variety of publicly available tools like LaZagne to gather credentials.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1003.005","description":"APT33 has used a variety of publicly available tools like LaZagne to gather credentials.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1027.013","description":"APT33 has used base64 to encode payloads.","sources":[{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1040","description":"APT33 has used SniffPass to collect credentials by sniffing network traffic.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}]},{"technique_id":"T1048.003","description":"APT33 has used FTP to exfiltrate files (separately from the C2 channel).","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}]},{"technique_id":"T1053.005","description":"APT33 has created a scheduled task to execute a .vbe file multiple times a day.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}]},{"technique_id":"T1059.001","description":"APT33 has utilized PowerShell to download files from the C2 server and run various scripts.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source":"Microsoft Holmium June 2020","url":"https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"}]},{"technique_id":"T1059.005","description":"APT33 has used VBScript to initiate the delivery of payloads.","sources":[{"source":"Microsoft Holmium June 2020","url":"https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"}]},{"technique_id":"T1068","description":"APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.","sources":[{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1071.001","description":"APT33 has used HTTP for command and control.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}]},{"technique_id":"T1078","description":"APT33 has used valid accounts for initial access and privilege escalation.","sources":[{"source":"FireEye APT33 Webinar Sept 2017","url":"https://www.brighttalk.com/webcast/10703/275683"},{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1078.004","description":"APT33 has used compromised Office 365 accounts in tandem with Ruler in an attempt to gain control of endpoints.","sources":[{"source":"Microsoft Holmium June 2020","url":"https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"}]},{"technique_id":"T1105","description":"APT33 has downloaded additional files and programs from its C2 server.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source":"Microsoft Holmium June 2020","url":"https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"}]},{"technique_id":"T1110.003","description":"APT33 has used password spraying to gain access to target systems.","sources":[{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"},{"source":"Microsoft Holmium June 2020","url":"https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"}]},{"technique_id":"T1132.001","description":"APT33 has used base64 to encode command and control traffic.","sources":[{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1203","description":"APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source":"Microsoft Holmium June 2020","url":"https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"}]},{"technique_id":"T1204.001","description":"APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.","sources":[{"source":"FireEye APT33 Sept 2017","url":"https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"},{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}]},{"technique_id":"T1204.002","description":"APT33 has used malicious e-mail attachments to lure victims into executing malware.","sources":[{"source":"Microsoft Holmium June 2020","url":"https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"}]},{"technique_id":"T1546.003","description":"APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.","sources":[{"source":"Microsoft Holmium June 2020","url":"https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"}]},{"technique_id":"T1547.001","description":"APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source":"Microsoft Holmium June 2020","url":"https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"}]},{"technique_id":"T1552.001","description":"APT33 has used a variety of publicly available tools like LaZagne to gather credentials.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1552.006","description":"APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1555","description":"APT33 has used a variety of publicly available tools like LaZagne to gather credentials.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1555.003","description":"APT33 has used a variety of publicly available tools like LaZagne to gather credentials.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"},{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1560.001","description":"APT33 has used WinRAR to compress data prior to exfil.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}]},{"technique_id":"T1566.001","description":"APT33 has sent spearphishing e-mails with archive attachments.","sources":[{"source":"Microsoft Holmium June 2020","url":"https://www.microsoft.com/security/blog/2020/06/18/inside-microsoft-threat-protection-mapping-attack-chains-from-cloud-to-endpoint/"}]},{"technique_id":"T1566.002","description":"APT33 has sent spearphishing emails containing links to .hta files.","sources":[{"source":"FireEye APT33 Sept 2017","url":"https://www.fireeye.com/blog/threat-research/2017/09/apt33-insights-into-iranian-cyber-espionage.html"},{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}]},{"technique_id":"T1571","description":"APT33 has used HTTP over TCP ports 808 and 880 for command and control.","sources":[{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}]},{"technique_id":"T1573.001","description":"APT33 has used AES for encryption of command and control traffic.","sources":[{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"}]},{"technique_id":"T1588.002","description":"APT33 has obtained and leveraged publicly-available tools for early intrusion activities.","sources":[{"source":"FireEye APT33 Guardrail","url":"https://www.fireeye.com/blog/threat-research/2018/12/overruled-containing-a-potentially-destructive-adversary.html"},{"source":"Symantec Elfin Mar 2019","url":"https://www.symantec.com/blogs/threat-intelligence/elfin-apt33-espionage"}]}]},{"id":"G0067","name":"APT37","procedures":[{"technique_id":"T1005","description":"APT37 has collected data from victims' local systems.","sources":[{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"technique_id":"T1027","description":"APT37 obfuscates strings and payloads.","sources":[{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"},{"source":"Securelist ScarCruft May 2019","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"},{"source":"Volexity InkySquid RokRAT August 2021","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"}]},{"technique_id":"T1027.003","description":"APT37 uses steganography to send images to users that are embedded with shellcode.","sources":[{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"},{"source":"Securelist ScarCruft May 2019","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"}]},{"technique_id":"T1033","description":"APT37 identifies the victim username.","sources":[{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1036.001","description":"APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”","sources":[{"source":"Securelist ScarCruft Jun 2016","url":"https://securelist.com/operation-daybreak/75100/"}]},{"technique_id":"T1053.005","description":"APT37 has created scheduled tasks to run malicious scripts on a compromised host.","sources":[{"source":"Volexity InkySquid RokRAT August 2021","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"}]},{"technique_id":"T1055","description":"APT37 injects its malware variant, ROKRAT, into the cmd.exe process.","sources":[{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1057","description":"APT37's Freenki malware lists running processes using the Microsoft Windows API.","sources":[{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1059","description":"APT37 has used Ruby scripts to execute payloads.","sources":[{"source":"Volexity InkySquid RokRAT August 2021","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"}]},{"technique_id":"T1059.003","description":"APT37 has used the command-line interface.","sources":[{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"},{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1059.005","description":"APT37 executes shellcode and a VBA script to decode Base64 strings.","sources":[{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1059.006","description":"APT37 has used Python scripts to execute payloads.","sources":[{"source":"Volexity InkySquid RokRAT August 2021","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"}]},{"technique_id":"T1071.001","description":"APT37 uses HTTPS to conceal C2 communications.","sources":[{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1082","description":"APT37 collects the computer name, the BIOS model, and execution path.","sources":[{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1102.002","description":"APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.","sources":[{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"},{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1105","description":"APT37 has downloaded second stage malware from compromised websites.","sources":[{"source":"Volexity InkySquid RokRAT August 2021","url":"https://www.volexity.com/blog/2021/08/24/north-korean-bluelight-special-inkysquid-deploys-rokrat/"},{"source":"Volexity InkySquid BLUELIGHT August 2021","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"},{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"},{"source":"Securelist ScarCruft May 2019","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"}]},{"technique_id":"T1106","description":"APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.","sources":[{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1120","description":"APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices.","sources":[{"source":"Securelist ScarCruft May 2019","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"}]},{"technique_id":"T1123","description":"APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.","sources":[{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"technique_id":"T1189","description":"APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.","sources":[{"source":"Volexity InkySquid BLUELIGHT August 2021","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"},{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"},{"source":"Securelist ScarCruft Jun 2016","url":"https://securelist.com/operation-daybreak/75100/"}]},{"technique_id":"T1203","description":"APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.","sources":[{"source":"Volexity InkySquid BLUELIGHT August 2021","url":"https://www.volexity.com/blog/2021/08/17/north-korean-apt-inkysquid-infects-victims-using-browser-exploits/"},{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"},{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"},{"source":"Securelist ScarCruft Jun 2016","url":"https://securelist.com/operation-daybreak/75100/"}]},{"technique_id":"T1204.002","description":"APT37 has sent spearphishing attachments attempting to get a user to open them.","sources":[{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"technique_id":"T1529","description":"APT37 has used malware that will issue the command shutdown /r /t 1 to reboot a system after wiping its MBR.","sources":[{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1547.001","description":"APT37's has added persistence via the Registry key HKCU\\Software\\Microsoft\\CurrentVersion\\Run\\.","sources":[{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"},{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1548.002","description":"APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.","sources":[{"source":"Securelist ScarCruft May 2019","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"}]},{"technique_id":"T1555.003","description":"APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.","sources":[{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"}]},{"technique_id":"T1559.002","description":"APT37 has used Windows DDE for execution of commands and a malicious VBS.","sources":[{"source":"Securelist ScarCruft Jun 2016","url":"https://securelist.com/operation-daybreak/75100/"}]},{"technique_id":"T1561.002","description":"APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).","sources":[{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"},{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]},{"technique_id":"T1566.001","description":"APT37 delivers malware using spearphishing emails with malicious HWP attachments.","sources":[{"source":"FireEye APT37 Feb 2018","url":"https://services.google.com/fh/files/misc/apt37-reaper-the-overlooked-north-korean-actor.pdf"},{"source":"Securelist ScarCruft May 2019","url":"https://securelist.com/scarcruft-continues-to-evolve-introduces-bluetooth-harvester/90729/"},{"source":"Talos Group123","url":"https://blog.talosintelligence.com/2018/01/korea-in-crosshairs.html"}]}]},{"id":"G0082","name":"APT38","procedures":[{"technique_id":"T1005","description":"APT38 has collected data from a compromised host.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1027.002","description":"APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1033","description":"APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1036.003","description":"APT38 has renamed system utilities, such as rundll32.exe and mshta.exe, to avoid detection.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1036.006","description":"APT38 has put several spaces before a file extension to avoid detection and suspicion.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1049","description":"APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1053.003","description":"APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1053.005","description":"APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence. Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1055","description":"APT38 has injected malicious payloads into the explorer.exe process.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1056.001","description":"APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1057","description":"APT38 leveraged Sysmon to understand the processes, services in the organization.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1059.001","description":"APT38 has used PowerShell to execute commands and other operational tasks.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1059.003","description":"APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine. Additionally, APT38 has used batch scripts.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"},{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1059.005","description":"APT38 has used VBScript to execute commands and other operational tasks.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1070.004","description":"APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1070.006","description":"APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1071.001","description":"APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1082","description":"APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1083","description":"APT38 have enumerated files and directories, or searched in specific locations within a compromised host.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1105","description":"APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine. Additionally, APT38 has downloaded other payloads onto a victim’s machine.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"},{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1106","description":"APT38 has used the Windows API to execute code within a victim's system.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1110","description":"APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1112","description":"APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1115","description":"APT38 used a Trojan called KEYLIME to collect data from the clipboard.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1135","description":"APT38 has enumerated network shares on a compromised host.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1140","description":"APT38 has used the RC4 algorithm to decrypt configuration data.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1189","description":"APT38 has conducted watering holes schemes to gain initial access to victims.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1204.001","description":"APT38 has used links to execute a malicious Visual Basic script.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1204.002","description":"APT38 has attempted to lure victims into enabling malicious macros within email attachments. Additionally, APT38 has used malicious Word documents and shortcut files.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1217","description":"APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1218.001","description":"APT38 has used CHM files to move concealed payloads.","sources":[{"source":"Kaspersky Lazarus Under The Hood APR 2017","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07180244/Lazarus_Under_The_Hood_PDF_final.pdf"}]},{"technique_id":"T1218.005","description":"APT38 has used a renamed version of mshta.exe to execute malicious HTML files.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1218.007","description":"APT38 has used msiexec.exe to execute malicious files.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1218.011","description":"APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1480.002","description":"APT38 has created a mutex to avoid duplicate execution.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1485","description":"APT38 has used a custom secure delete function to make deleted files unrecoverable.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1486","description":"APT38 has used Hermes ransomware to encrypt files with AES256.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1505.003","description":"APT38 has used web shells for persistence or to ensure redundant access.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1518.001","description":"APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"},{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1529","description":"APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1543.003","description":"APT38 has installed a new Windows service to establish persistence.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1548.002","description":"APT38 has used the legitimate application ieinstal.exe to bypass UAC.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1553.005","description":"APT38 has used ISO and VHD files to deploy malware and to bypass Mark-of-the-Web (MOTW) security measures.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1561.002","description":"APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1565.001","description":"APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1565.002","description":"APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1565.003","description":"APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1566.001","description":"APT38 has conducted spearphishing campaigns using malicious email attachments.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1569.002","description":"APT38 has created new services or modified existing ones to run executables, commands, or scripts.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1583.001","description":"APT38 has created fake domains to imitate legitimate venture capital or bank domains.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1588.002","description":"APT38 has obtained and used open-source tools such as Mimikatz.","sources":[{"source":"ESET Lazarus KillDisk April 2018","url":"https://www.welivesecurity.com/2018/04/03/lazarus-killdisk-central-american-casino/"}]},{"technique_id":"T1685","description":"APT38 has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools.","sources":[{"source":"1 - appv","url":"https://securelist.com/bluenoroff-methods-bypass-motw/108383/"}]},{"technique_id":"T1685.005","description":"APT38 clears Window Event logs and Sysmon logs from the system.","sources":[{"source":"FireEye APT38 Oct 2018","url":"https://services.google.com/fh/files/misc/apt38-un-usual-suspects.pdf"}]},{"technique_id":"T1686","description":"APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1686.002","description":"APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]},{"technique_id":"T1690","description":"APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.","sources":[{"source":"CISA AA20-239A BeagleBoyz August 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-239a"}]}]},{"id":"G0087","name":"APT39","procedures":[{"technique_id":"T1003","description":"APT39 has used different versions of Mimikatz to obtain credentials.","sources":[{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1003.001","description":"APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"}]},{"technique_id":"T1005","description":"APT39 has used various tools to steal files from the compromised host.","sources":[{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"},{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1012","description":"APT39 has used various strains of malware to query the Registry.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1018","description":"APT39 has used NBTscan and custom tools to discover remote systems.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"},{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}]},{"technique_id":"T1021.001","description":"APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1021.002","description":"APT39 has used SMB for lateral movement.","sources":[{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}]},{"technique_id":"T1021.004","description":"APT39 used secure shell (SSH) to move laterally among their targets.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"}]},{"technique_id":"T1027.002","description":"APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1027.013","description":"APT39 has used malware to drop encrypted CAB files.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1033","description":"APT39 used Remexi to collect usernames from the system.","sources":[{"source":"Symantec Chafer Dec 2015","url":"https://www.symantec.com/connect/blogs/iran-based-attackers-use-back-door-threats-spy-middle-eastern-targets"}]},{"technique_id":"T1036.005","description":"APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"},{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1041","description":"APT39 has exfiltrated stolen victim data through C2 communications.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1046","description":"APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1053.005","description":"APT39 has created scheduled tasks for persistence.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"},{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1056","description":"APT39 has utilized tools to capture mouse movements.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1056.001","description":"APT39 has used tools for capturing keystrokes.","sources":[{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"},{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1059","description":"APT39 has utilized custom scripts to perform internal reconnaissance.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"},{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"}]},{"technique_id":"T1059.001","description":"APT39 has used PowerShell to execute malicious code.","sources":[{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"},{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}]},{"technique_id":"T1059.005","description":"APT39 has utilized malicious VBS scripts in malware.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1059.006","description":"APT39 has used a command line utility and a network scanner written in python.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"},{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1059.010","description":"APT39 has utilized AutoIt malware scripts embedded in Microsoft Office documents or malicious links.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1070.004","description":"APT39 has used malware to delete files after they are deployed on a compromised host.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1071.001","description":"APT39 has used HTTP in communications with C2.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"},{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1071.004","description":"APT39 has used remote access tools that leverage DNS in communications with C2.","sources":[{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1074.001","description":"APT39 has utilized tools to aggregate data prior to exfiltration.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1078","description":"APT39 has used stolen credentials to compromise Outlook Web Access (OWA).","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"}]},{"technique_id":"T1083","description":"APT39 has used tools with the ability to search for files on a compromised host.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1090.001","description":"APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1090.002","description":"APT39 has used various tools to proxy C2 communications.","sources":[{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1102.002","description":"APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.","sources":[{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1105","description":"APT39 has downloaded tools to compromised hosts.","sources":[{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"},{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1110","description":"APT39 has used Ncrack to reveal credentials.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"}]},{"technique_id":"T1113","description":"APT39 has used a screen capture utility to take screenshots on a compromised host.","sources":[{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"},{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1115","description":"APT39 has used tools capable of stealing contents of the clipboard.","sources":[{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}]},{"technique_id":"T1135","description":"APT39 has used the post exploitation tool CrackMapExec to enumerate network shares.","sources":[{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1136.001","description":"APT39 has created accounts on multiple compromised hosts to perform actions within the network.","sources":[{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1140","description":"APT39 has used malware to decrypt encrypted CAB files.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1190","description":"APT39 has used SQL injection for initial compromise.","sources":[{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}]},{"technique_id":"T1197","description":"APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1204.001","description":"APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1204.002","description":"APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"},{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"},{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}]},{"technique_id":"T1505.003","description":"APT39 has installed ANTAK and ASPXSPY web shells.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"}]},{"technique_id":"T1546.010","description":"APT39 has used malware to set LoadAppInit_DLLs in the Registry key SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Windows in order to establish persistence.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1547.001","description":"APT39 has maintained persistence using the startup folder.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"}]},{"technique_id":"T1547.009","description":"APT39 has modified LNK shortcuts.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"}]},{"technique_id":"T1553.006","description":"APT39 has used malware to turn off the RequireSigned feature which ensures only signed DLLs can be run on Windows.","sources":[{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1555","description":"APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.","sources":[{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]},{"technique_id":"T1560.001","description":"APT39 has used WinRAR and 7-Zip to compress an archive stolen data.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"}]},{"technique_id":"T1566.001","description":"APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"},{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1566.002","description":"APT39 leveraged spearphishing emails with malicious links to initially compromise victims.","sources":[{"source":"FireEye APT39 Jan 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/apt39-iranian-cyber-espionage-group-focused-on-personal-information.html"},{"source":"FBI FLASH APT39 September 2020","url":"https://www.iranwatch.org/sites/default/files/public-intelligence-alert.pdf"}]},{"technique_id":"T1569.002","description":"APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.","sources":[{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"},{"source":"Symantec Chafer February 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/chafer-latest-attacks-reveal-heightened-ambitions"}]},{"technique_id":"T1588.002","description":"APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.","sources":[{"source":"IBM ITG07 June 2019","url":"https://securityintelligence.com/posts/observations-of-itg07-cyber-operations/"},{"source":"BitDefender Chafer May 2020","url":"https://www.bitdefender.com/blog/labs/iranian-chafer-apt-targeted-air-transportation-and-government-in-kuwait-and-saudi-arabia/"}]}]},{"id":"G0096","name":"APT41","procedures":[{"technique_id":"T1003.001","description":"APT41 has used hashdump, Mimikatz, Procdump, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.","sources":[{"source":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"},{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1003.002","description":"APT41 extracted user account data from the Security Account Managerr (SAM), making a copy of this database from the registry using the reg save command or by exploiting volume shadow copies.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1003.003","description":"APT41 used ntdsutil to obtain a copy of the victim environment ntds.dit file.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1005","description":"APT41 has uploaded files and data from a compromised host.","sources":[{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1008","description":"APT41 used the Steam community page as a fallback mechanism for C2.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1012","description":"APT41 queried registry values to determine items such as configured RDP ports and network configurations.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1014","description":"APT41 deployed rootkits on Linux systems.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1016","description":"APT41 collected MAC addresses from victim machines.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1018","description":"APT41 has used MiPing to discover active systems in the victim network.","sources":[{"source":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"}]},{"technique_id":"T1021.001","description":"APT41 used RDP for lateral movement. APT41 used NATBypass to expose local RDP ports on compromised systems to the Internet.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"},{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1021.002","description":"APT41 has transferred implant files using Windows Admin Shares and the Server Message Block (SMB) protocol, then executes files through Windows Management Instrumentation (WMI).","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"}]},{"technique_id":"T1027","description":"APT41 used VMProtected binaries in multiple intrusions.","sources":[{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}]},{"technique_id":"T1027.002","description":"APT41 uses packers such as Themida to obfuscate malicious files.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1030","description":"APT41 transfers post-exploitation files dividing the payload into fixed-size chunks to evade detection.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1033","description":"APT41 has executed whoami commands, including using the WMIEXEC utility to execute this on remote machines.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1036.004","description":"APT41 has created services to appear as benign system tools.","sources":[{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1036.005","description":"APT41 attempted to masquerade their files as popular anti-virus software.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1037","description":"APT41 used a hidden shell script in /etc/rc.d/init.d to leverage the ADORE.XSECbackdoor and Adore-NG rootkit.","sources":[{"source":"apt41_mandiant","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1046","description":"APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1047","description":"APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit. APT41 has executed files through Windows Management Instrumentation (WMI).","sources":[{"source":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"},{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1049","description":"APT41 has enumerated IP addresses of network resources and used the netstat command as part of network reconnaissance. The group has also used a malware variant, HIGHNOON, to enumerate active RDP sessions.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1053.005","description":"APT41 used a compromised account to create a scheduled task on a system.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1055","description":"APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1056.001","description":"APT41 used a keylogger called GEARSHIFT on a target system.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1059.001","description":"APT41 leveraged PowerShell to deploy malware families in victims’ environments.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}]},{"technique_id":"T1059.003","description":"APT41 used cmd.exe /c to execute commands on remote machines. APT41 used a batch file to install persistence for the Cobalt Strike BEACON loader.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}]},{"technique_id":"T1059.004","description":"APT41 used Linux shell commands for system survey and information gathering prior to exploitation of vulnerabilities such as CVE-2019-19871.","sources":[{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}]},{"technique_id":"T1069","description":"APT41 used net group commands to enumerate various Windows user groups and permissions.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1070.003","description":"APT41 attempted to remove evidence of some of its activity by deleting Bash histories.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1070.004","description":"APT41 deleted files from the system.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1071.001","description":"APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.","sources":[{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}]},{"technique_id":"T1071.002","description":"APT41 used exploit payloads that initiate download via ftp.","sources":[{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}]},{"technique_id":"T1071.004","description":"APT41 used DNS for C2 communications.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1078","description":"APT41 used compromised credentials to log on to other systems.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1082","description":"APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1083","description":"APT41 has executed file /bin/pwd on exploited victims, perhaps to return architecture related information.","sources":[{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}]},{"technique_id":"T1087.001","description":"APT41 used built-in net commands to enumerate local administrator groups.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1087.002","description":"APT41 used built-in net commands to enumerate domain administrator users.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1090","description":"APT41 used a tool called CLASSFON to covertly proxy network communications.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1098.007","description":"APT41 has added user accounts to the User and Admin groups.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1102.001","description":"APT41 used legitimate websites for C2 through dead drop resolvers (DDR), including GitHub, Pastebin, and Microsoft TechNet.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1104","description":"APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.","sources":[{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"}]},{"technique_id":"T1105","description":"APT41 used certutil to download additional files. APT41 downloaded post-exploitation tools such as Cobalt Strike via command shell following initial access. APT41 has uploaded Procdump and NATBypass to a staging directory and has used these tools in follow-on activities.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"},{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"},{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1110","description":"APT41 performed password brute-force attacks on the local admin account.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1112","description":"APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1133","description":"APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1135","description":"APT41 used the net share command as part of network reconnaissance.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1136.001","description":"APT41 has created user accounts.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1190","description":"APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central through unsafe deserialization, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices. APT41 leveraged vulnerabilities such as ProxyLogon exploitation or SQL injection for initial access. APT41 exploited CVE-2021-26855 against a vulnerable Microsoft Exchange Server to gain initial access to the victim network.","sources":[{"source":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"},{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"},{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1195.002","description":"APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1197","description":"APT41 used BITSAdmin to download and install payloads.","sources":[{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"},{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"}]},{"technique_id":"T1203","description":"APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1213.003","description":"APT41 cloned victim user Git repositories during intrusions.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1218.001","description":"APT41 used compiled HTML (.chm) files for targeting.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1218.011","description":"APT41 has used rundll32.exe to execute a loader.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"}]},{"technique_id":"T1480.001","description":"APT41 has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines. APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.","sources":[{"source":"Twitter ItsReallyNick APT41 EK","url":"https://x.com/ItsReallyNick/status/1189622925286084609"}]},{"technique_id":"T1484.001","description":"APT41 used scheduled tasks created via Group Policy Objects (GPOs) to deploy ransomware.","sources":[{"source":"apt41_mandiant","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1486","description":"APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user. APT41 also used Microsoft Bitlocker to encrypt workstations and Jetico’s BestCrypt to encrypt servers.","sources":[{"source":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"},{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1496.001","description":"APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"apt41_mandiant","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1542.003","description":"APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1543.003","description":"APT41 modified legitimate Windows services to install malware backdoors. APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1546.008","description":"APT41 leveraged sticky keys to establish persistence.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1547.001","description":"APT41 created and modified startup files for persistence. APT41 added a registry key in HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Svchost to establish persistence for Cobalt Strike.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1550.002","description":"APT41 uses tools such as Mimikatz to enable lateral movement via captured password hashes.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1553.002","description":"APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1555","description":"APT41 has obtained information about accounts, lists of employees, and plaintext and hashed passwords from databases.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1555.003","description":"APT41 used BrowserGhost, a tool designed to obtain credentials from browsers, to retrieve information from password stores.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1560.001","description":"APT41 created a RAR archive of targeted files for exfiltration. Additionally, APT41 used the makecab.exe utility to both download tools, such as NATBypass, to the victim network and to archive a file for exfiltration.","sources":[{"source":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"},{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1566.001","description":"APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1568.002","description":"APT41 has used DGAs to change their C2 servers monthly.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1569.002","description":"APT41 used svchost.exe and Net to execute a system service installed to launch a Cobalt Strike BEACON loader.","sources":[{"source":"FireEye APT41 March 2020","url":"https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.html"},{"source":"Group IB APT 41 June 2021","url":"https://www.group-ib.com/blog/colunmtk-apt41/"}]},{"technique_id":"T1570","description":"APT41 uses remote shares to move and remotely execute payloads during lateral movemement.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1574.001","description":"APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. APT41 has also used legitimate executables to perform DLL side-loading of their malware.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1574.006","description":"APT41 has configured payloads to load via LD_PRELOAD.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"}]},{"technique_id":"T1588.002","description":"APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1595.002","description":"APT41 used the Acunetix SQL injection vulnerability scanner in target reconnaissance operations, as well as the JexBoss tool to identify vulnerabilities in Java applications.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1595.003","description":"APT41 leverages various tools and frameworks to brute-force directories on web servers.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1596.005","description":"APT41 uses the Chinese website fofa.su, similar to the Shodan scanning service, for passive scanning of victims.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1599","description":"APT41 used NATBypass to bypass firewall restrictions and to access compromised systems via RDP.","sources":[{"source":"apt41_dcsocytec_dec2022","url":"https://medium.com/@DCSO_CyTec/apt41-the-spy-who-failed-to-encrypt-me-24fc0f49cad1"}]},{"technique_id":"T1684.001","description":"APT41 impersonated an employee at a video game developer company to send phishing emails.","sources":[{"source":"apt41_mandiant","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]},{"technique_id":"T1685","description":"APT41 developed a custom injector that enables an Event Tracing for Windows (ETW) bypass, making malicious processes invisible to Windows logging.","sources":[{"source":"Rostovcev APT41 2021","url":"https://www.group-ib.com/blog/apt41-world-tour-2021/"}]},{"technique_id":"T1685.005","description":"APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.","sources":[{"source":"FireEye APT41 Aug 2019","url":"https://www.mandiant.com/sites/default/files/2022-02/rt-apt41-dual-operation.pdf"}]}]},{"id":"G1044","name":"APT42","procedures":[{"technique_id":"T1016","description":"APT42 has used malware, such as GHAMBAR and POWERPOST, to collect network information.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1036.005","description":"APT42 has masqueraded the VINETHORN payload as a VPN application.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1047","description":"APT42 has used Windows Management Instrumentation (WMI) to query anti-virus products.","sources":[{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1053.005","description":"APT42 has used scheduled tasks for persistence.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1056","description":"APT42 has used credential harvesting websites.","sources":[{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1056.001","description":"APT42 has used custom malware to log keystrokes.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1059.001","description":"APT42 has downloaded and executed PowerShell payloads.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1059.005","description":"APT42 has used a VBScript to query anti-virus products.","sources":[{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1070","description":"APT42 has cleared Chrome browser history.","sources":[{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1070.008","description":"APT42 has deleted login notification emails and has cleared the Sent folder to cover their tracks.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1071.001","description":"APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.","sources":[{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1082","description":"APT42 has used malware, such as GHAMBAR and POWERPOST, to collect system information.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1087.001","description":"APT42 has used the PowerShell-based POWERPOST script to collect local account names from the victim machine.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1102","description":"APT42 has used various links, such as links with typo-squatted domains, links to Dropbox files and links to fake Google sites, in spearphishing operations.","sources":[{"source":"TAG APT42","url":"https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/"},{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"},{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1111","description":"APT42 has intercepted SMS-based one-time passwords and has set up two-factor authentication. Additionally, APT42 has used cloned or fake websites to capture MFA tokens.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"},{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1112","description":"APT42 has modified Registry keys to maintain persistence.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1113","description":"APT42 has used malware, such as GHAMBAR and POWERPOST, to take screenshots.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1132.001","description":"APT42 has encoded C2 traffic with Base64.","sources":[{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1518.001","description":"APT42 has used Windows Management Instrumentation (WMI) to check for anti-virus products.","sources":[{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1530","description":"APT42 has collected data from Microsoft 365 environments.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"},{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1539","description":"APT42 has used custom malware to steal login and cookie data from common browsers.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1547","description":"APT42 has modified the Registry to maintain persistence.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1555.003","description":"APT42 has used custom malware to steal credentials.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1566.002","description":"APT42 has sent spearphishing emails containing malicious links.","sources":[{"source":"TAG APT42","url":"https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/"},{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"},{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1573.002","description":"APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.","sources":[{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1583.001","description":"APT42 has registered domains, several of which masqueraded as news outlets and login services, for use in operations.","sources":[{"source":"TAG APT42","url":"https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/"},{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1583.003","description":"APT42 has used anonymized infrastructure and Virtual Private Servers (VPSs) to interact with the victim’s environment.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"},{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1585.002","description":"APT42 has created email accounts to use in spearphishing operations.","sources":[{"source":"TAG APT42","url":"https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/"}]},{"technique_id":"T1588.002","description":"APT42 has used built-in features in the Microsoft 365 environment and publicly available tools to avoid detection.","sources":[{"source":"Mandiant APT42-untangling","url":"https://cloud.google.com/blog/topics/threat-intelligence/untangling-iran-apt42-operations"}]},{"technique_id":"T1608.001","description":"APT42 has used its infrastructure for C2 and for staging the VINETHORN payload, which masqueraded as a VPN application.","sources":[{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]},{"technique_id":"T1682","description":"APT42 has leveraged LLMs to search for official emails to build target lists, and conduct reconnaissance on potential business partners.","sources":[{"source":"GTIG AI Threat Tracker","url":"https://cloud.google.com/blog/topics/threat-intelligence/distillation-experimentation-integration-ai-adversarial-use"}]},{"technique_id":"T1684.001","description":"APT42 has impersonated legitimate people in phishing emails to gain credentials.","sources":[{"source":"TAG APT42","url":"https://blog.google/threat-analysis-group/iranian-backed-group-steps-up-phishing-campaigns-against-israel-us/"},{"source":"Mandiant APT42-charms","url":"https://services.google.com/fh/files/misc/apt42-crooked-charms-cons-and-compromises.pdf"}]}]},{"id":"G1023","name":"APT5","procedures":[{"technique_id":"T1003.001","description":"APT5 has used the Task Manager process to target LSASS process memory in order to obtain NTLM password hashes. APT5 has also dumped clear text passwords and hashes from memory using Mimikatz hosted through an RDP mapped drive.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1003.002","description":"APT5 has copied and exfiltrated the SAM Registry hive from targeted systems.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1021.001","description":"APT5 has moved laterally throughout victim environments using RDP.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1021.004","description":"APT5 has used SSH for lateral movement in compromised environments including for enabling access to ESXi host servers.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1036.005","description":"APT5 has named exfiltration archives to mimic Windows Updates at times using filenames with a KB.zip pattern.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1049","description":"APT5 has used the BLOODMINE utility to collect data on web requests from Pulse Secure Connect logs.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1053.003","description":"APT5 has made modifications to the crontab file including in /var/cron/tabs/.","sources":[{"source":"NSA APT5 Citrix Threat Hunting December 2022","url":"https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF"}]},{"technique_id":"T1055","description":"APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to alter its functionality.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1056.001","description":"APT5 has used malware with keylogging capabilities to monitor the communications of targeted entities.","sources":[{"source":"FireEye Southeast Asia Threat Landscape March 2015","url":"https://web.archive.org/web/20220122121143/https://www.fireeye.com/content/dam/fireeye-www/current-threats/pdfs/rpt-southeast-asia-threat-landscape.pdf"},{"source":"Mandiant Advanced Persistent Threats","url":"https://www.mandiant.com/resources/insights/apt-groups"}]},{"technique_id":"T1057","description":"APT5 has used Windows-based utilities to carry out tasks including tasklist.exe.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1059.001","description":"APT5 has used PowerShell to accomplish tasks within targeted environments.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1059.003","description":"APT5 has used cmd.exe for execution on compromised systems.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1070","description":"APT5 has used the THINBLOOD utility to clear SSL VPN log files located at /home/runtime/logs.","sources":[{"source":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"},{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1070.003","description":"APT5 has cleared the command history on targeted ESXi servers.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1070.004","description":"APT5 has deleted scripts and web shells to evade detection.","sources":[{"source":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"},{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1070.006","description":"APT5 has modified file timestamps.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1074.001","description":"APT5 has staged data on compromised systems prior to exfiltration often in C:\\Users\\Public.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1078.002","description":"APT5 has used legitimate account credentials to move laterally through compromised environments.","sources":[{"source":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"}]},{"technique_id":"T1078.004","description":"APT5 has accessed Microsoft M365 cloud environments using stolen credentials.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1083","description":"APT5 has used the BLOODMINE utility to discover files with .css, .jpg, .png, .gif, .ico, .js, and .jsp extensions in Pulse Secure Connect logs.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1098.007","description":"APT5 has created their own accounts with Local Administrator privileges to maintain access to systems with short-cycle credential rotation.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1136.001","description":"APT5 has created Local Administrator accounts to maintain access to systems with short-cycle credential rotation.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1190","description":"APT5 has exploited vulnerabilities in externally facing software and devices including Pulse Secure VPNs and Citrix Application Delivery Controllers.","sources":[{"source":"Microsoft East Asia Threats September 2023","url":"https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RW1aFyW"},{"source":"NSA APT5 Citrix Threat Hunting December 2022","url":"https://media.defense.gov/2022/Dec/13/2003131586/-1/-1/0/CSA-APT5-CITRIXADC-V1.PDF"},{"source":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"},{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1505.003","description":"APT5 has installed multiple web shells on compromised servers including on Pulse Secure VPN appliances.","sources":[{"source":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"},{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1554","description":"APT5 has modified legitimate binaries and scripts for Pulse Secure VPNs including the legitimate DSUpgrade.pm file to install the ATRIUM webshell for persistence.","sources":[{"source":"Mandiant Pulse Secure Zero-Day April 2021","url":"https://www.mandiant.com/resources/blog/suspected-apt-actors-leverage-bypass-techniques-pulse-secure-zero-day"},{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1560.001","description":"APT5 has used the JAR/ZIP file format for exfiltrated files.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1583.005","description":"APT5 has acquired a network of compromised systems – specifically an ORB (operational relay box) network – for follow on activities.","sources":[{"source":"ORB Mandiant","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"}]},{"technique_id":"T1654","description":"APT5 has used the BLOODMINE utility to parse and extract information from Pulse Secure Connect logs.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]},{"technique_id":"T1685","description":"APT5 has used the CLEANPULSE utility to insert command line strings into a targeted process to prevent certain log events from occurring.","sources":[{"source":"Mandiant Pulse Secure Update May 2021","url":"https://www.mandiant.com/resources/blog/updates-on-chinese-apt-compromising-pulse-secure-vpn-devices"}]}]},{"id":"G0143","name":"Aquatic Panda","procedures":[{"technique_id":"T1003.001","description":"Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1005","description":"Aquatic Panda captured local Windows security event log data from victim machines using the wevtutil utility to extract contents to an evtx output file.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1007","description":"Aquatic Panda has attempted to discover services for third party EDR products.","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1021","description":"Aquatic Panda used remote scheduled tasks to install malicious software on victim systems during lateral movement actions.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1021.001","description":"Aquatic Panda leveraged stolen credentials to move laterally via RDP in victim environments.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1021.002","description":"Aquatic Panda used remote shares to enable lateral movement in victim environments.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1021.004","description":"Aquatic Panda used SSH with captured user credentials to move laterally in victim environments.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1027.010","description":"Aquatic Panda has encoded PowerShell commands in Base64.","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1033","description":"Aquatic Panda gathers information on recently logged-in users on victim devices.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1036.004","description":"Aquatic Panda created new, malicious services using names such as Windows User Service to attempt to blend in with legitimate items on victim systems.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1036.005","description":"Aquatic Panda renamed or moved malicious binaries to legitimate locations to evade defenses and blend into victim environments.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1047","description":"Aquatic Panda used WMI for lateral movement in victim environments.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1059.001","description":"Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1059.003","description":"Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to cmd /C.","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1059.004","description":"Aquatic Panda used malicious shell scripts in Linux environments following access via SSH to install Linux versions of Winnti malware.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1070.003","description":"Aquatic Panda cleared command history in Linux environments to remove traces of activity after operations.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1070.004","description":"Aquatic Panda has deleted malicious executables from compromised machines.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"},{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1078.002","description":"Aquatic Panda used multiple mechanisms to capture valid user accounts for victim domains to enable lateral movement and access to additional hosts in victim environments.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1082","description":"Aquatic Panda has used native OS commands to understand privilege levels and system details.","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1087","description":"Aquatic Panda used the last command in Linux environments to identify recently logged-in users on victim machines.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1105","description":"Aquatic Panda has downloaded additional malware onto compromised hosts.","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1112","description":"Aquatic Panda modified the victim registry to enable the RestrictedAdmin mode feature, allowing for pass the hash behaviors to function via RDP.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1218.011","description":"Aquatic Panda used rundll32.exe to proxy execution of a malicious DLL file identified as a keylogging binary.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1518.001","description":"Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1543.003","description":"Aquatic Panda created new Windows services for persistence that masqueraded as legitimate Windows services via name change.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1550.002","description":"Aquatic Panda used a registry edit to enable a Windows feature called RestrictedAdmin in victim environments. This change allowed Aquatic Panda to leverage \"pass the hash\" mechanisms as the alteration allows for RDP connections with a valid account name and hash only, without possessing a cleartext password value.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1560.001","description":"Aquatic Panda has used several publicly available tools, including WinRAR and 7zip, to compress collected files and memory dumps prior to exfiltration.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"},{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1574.001","description":"Aquatic Panda has used DLL search-order hijacking to load exe, dll, and dat files into memory. Aquatic Panda loaded a malicious DLL into the legitimate Windows Security Health Service executable (SecurityHealthService.exe) to execute malicious code on victim systems.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"},{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1574.006","description":"Aquatic Panda modified the ld.so preload file in Linux environments to enable persistence for Winnti malware.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1588.001","description":"Aquatic Panda has acquired and used njRAT in its operations.","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1588.002","description":"Aquatic Panda has acquired and used Cobalt Strike in its operations.","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1595.002","description":"Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1654","description":"Aquatic Panda enumerated logs related to authentication in Linux environments prior to deleting selective entries for defense evasion purposes.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]},{"technique_id":"T1685","description":"Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.","sources":[{"source":"CrowdStrike AQUATIC PANDA December 2021","url":"https://www.crowdstrike.com/blog/overwatch-exposes-aquatic-panda-in-possession-of-log-4-shell-exploit-tools/"}]},{"technique_id":"T1685.005","description":"Aquatic Panda clears Windows Event Logs following activity to evade defenses.","sources":[{"source":"Crowdstrike HuntReport 2022","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/2022OverWatchThreatHuntingReport.pdf"}]}]},{"id":"G0001","name":"Axiom","procedures":[{"technique_id":"T1001.002","description":"Axiom has used steganography to hide its C2 communications.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1003","description":"Axiom has been known to dump credentials.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1005","description":"Axiom has collected data from a compromised network.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1021.001","description":"Axiom has used RDP during operations.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1078","description":"Axiom has used previously compromised administrative accounts to escalate privileges.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1189","description":"Axiom has used watering hole attacks to gain access.","sources":[]},{"technique_id":"T1190","description":"Axiom has been observed using SQL injection to gain access to systems.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1203","description":"Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.","sources":[]},{"technique_id":"T1546.008","description":"Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1553","description":"Axiom has used digital certificates to deliver malware.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1560","description":"Axiom has compressed and encrypted data prior to exfiltration.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1563.002","description":"Axiom has targeted victims with remote administration tools including RDP.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1566","description":"Axiom has used spear phishing to initially compromise victims.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1583.002","description":"Axiom has acquired dynamic DNS services for use in the targeting of intended victims.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1583.003","description":"Axiom has used VPS hosting providers in targeting of intended victims.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]},{"technique_id":"T1584.005","description":"Axiom has used large groups of compromised machines for use as proxy nodes.","sources":[{"source":"Novetta-Axiom","url":"https://web.archive.org/web/20230115144216/http://www.novetta.com/wp-content/uploads/2014/11/Executive_Summary-Final_1.pdf"}]}]},{"id":"G0135","name":"BackdoorDiplomacy","procedures":[{"technique_id":"T1027","description":"BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1036.004","description":"BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1036.005","description":"BackdoorDiplomacy has dropped implants in folders named for legitimate software.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1046","description":"BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1049","description":"BackdoorDiplomacy has used NetCat and PortQry to enumerate network connections and display the status of related TCP and UDP ports.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1055.001","description":"BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1074.001","description":"BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1095","description":"BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1105","description":"BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1120","description":"BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1190","description":"BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor. BackdoorDiplomacy has also exploited mis-configured Plesk servers.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1505.003","description":"BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1574.001","description":"BackdoorDiplomacy has executed DLL search order hijacking.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1588.001","description":"BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]},{"technique_id":"T1588.002","description":"BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.","sources":[{"source":"ESET BackdoorDiplomacy Jun 2021","url":"https://www.welivesecurity.com/2021/06/10/backdoordiplomacy-upgrading-quarian-turian/"}]}]},{"id":"G1002","name":"BITTER","procedures":[{"technique_id":"T1027.013","description":"BITTER has used a RAR SFX dropper to deliver malware.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]},{"technique_id":"T1036.004","description":"BITTER has disguised malware as a Windows Security update service.","sources":[{"source":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"technique_id":"T1053.005","description":"BITTER has used scheduled tasks for persistence and execution.","sources":[{"source":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"technique_id":"T1068","description":"BITTER has exploited CVE-2021-1732 for privilege escalation.","sources":[{"source":"DBAPPSecurity BITTER zero-day Feb 2021","url":"https://ti.dbappsecurity.com.cn/blog/articles/2021/02/10/windows-kernel-zero-day-exploit-is-used-by-bitter-apt-in-targeted-attack/"},{"source":"Microsoft CVE-2021-1732 Feb 2021","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-1732"}]},{"technique_id":"T1071.001","description":"BITTER has used HTTP POST requests for C2.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"},{"source":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"technique_id":"T1095","description":"BITTER has used TCP for C2 communications.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]},{"technique_id":"T1105","description":"BITTER has downloaded additional malware and tools onto a compromised host.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"},{"source":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"technique_id":"T1203","description":"BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"},{"source":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"technique_id":"T1204.002","description":"BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"},{"source":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"technique_id":"T1559.002","description":"BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.","sources":[{"source":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"technique_id":"T1566.001","description":"BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"},{"source":"Cisco Talos Bitter Bangladesh May 2022","url":"https://blog.talosintelligence.com/2022/05/bitter-apt-adds-bangladesh-to-their.html"}]},{"technique_id":"T1568","description":"BITTER has used DDNS for C2 communications.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]},{"technique_id":"T1573","description":"BITTER has encrypted their C2 communications.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]},{"technique_id":"T1583.001","description":"BITTER has registered a variety of domains to host malicious payloads and for C2.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]},{"technique_id":"T1588.002","description":"BITTER has obtained tools such as PuTTY for use in their operations.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]},{"technique_id":"T1608.001","description":"BITTER has registered domains to stage payloads.","sources":[{"source":"Forcepoint BITTER Pakistan Oct 2016","url":"https://www.forcepoint.com/blog/x-labs/bitter-targeted-attack-against-pakistan"}]}]},{"id":"G1043","name":"BlackByte","procedures":[{"technique_id":"T1003","description":"BlackByte used tools such as Cobalt Strike and Mimikatz to dump credentials from victim systems.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1012","description":"BlackByte queried registry values to determine system language settings.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"}]},{"technique_id":"T1016","description":"BlackByte used tools such as Arp to pull system network information and identify connected devices.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1018","description":"BlackByte used tools such as Arp to identify remotely-connected devices.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1021.001","description":"BlackByte has used RDP to access other hosts within victim networks.","sources":[{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"},{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1021.002","description":"BlackByte used SMB file shares to distribute payloads throughout victim networks, including BlackByte ransomware variants during wormable operations.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"},{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1036.008","description":"BlackByte masqueraded configuration files containing encryption keys as PNG files.","sources":[{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1041","description":"BlackByte transmitted collected victim host information via HTTP POST to command and control infrastructure.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1046","description":"BlackByte has used tools such as NetScan to enumerate network services in victim environments.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1047","description":"BlackByte used WMI to delete Volume Shadow Copies on victim machines.","sources":[{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1053.005","description":"BlackByte created scheduled tasks for payload execution.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1055","description":"BlackByte has injected Cobalt Strike into wuauclt.exe during intrusions. BlackByte has injected ransomware into svchost.exe before encryption.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}]},{"technique_id":"T1055.012","description":"BlackByte used process hollowing for defense evasion purposes.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1059.001","description":"BlackByte used encoded PowerShell commands during operations. BlackByte has used remote PowerShell commands in victim networks.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1059.003","description":"BlackByte executed ransomware using the Windows command shell.","sources":[{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1068","description":"BlackByte has exploited CVE-2024-37085 in VMWare ESXi software for authentication bypass and subsequent privilege escalation.","sources":[{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"}]},{"technique_id":"T1070.004","description":"BlackByte deleted ransomware executables post-encryption.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"},{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}]},{"technique_id":"T1071.001","description":"BlackByte collected victim device information then transmitted this via HTTP POST to command and control infrastructure.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1078","description":"BlackByte has gained access to victim environments through legitimate VPN credentials.","sources":[{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"}]},{"technique_id":"T1078.002","description":"BlackByte captured credentials for or impersonated domain administration users.","sources":[{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"},{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1082","description":"BlackByte used various system commands and tools to pull system information during operations.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"},{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1087.002","description":"BlackByte has used tools such as AdFind to identify and enumerate domain accounts.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1105","description":"BlackByte has transferred tools such as Cobalt Strike to victim environments from file sharing and hosting websites.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1112","description":"BlackByte performed Registry modifications to escalate privileges and disable security tools.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"}]},{"technique_id":"T1134.003","description":"BlackByte constructed a valid authentication token following Microsoft Exchange exploitation to allow for follow-on privileged command execution.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1135","description":"BlackByte enumerated network shares on victim devices.","sources":[{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"}]},{"technique_id":"T1136.002","description":"BlackByte created privileged domain accounts during intrusions.","sources":[{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"}]},{"technique_id":"T1140","description":"BlackByte has encoded commands in base64-encoded sections concatenated together in PowerShell. BlackByte uses PowerShell commands to disable Windows Defender.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1190","description":"BlackByte exploited vulnerabilities such as ProxyLogon and ProxyShell for initial access to victim environments.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"},{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1219","description":"BlackByte has used tools such as AnyDesk in victim environments.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1480","description":"BlackByte stopped execution if identified language settings on victim machines was Russian or one of several language associated with former Soviet republics. BlackByte has used ransomware variants requiring a key passed on the command line for the malware to execute.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"}]},{"technique_id":"T1482","description":"BlackByte enumerated Active Directory information and trust relationships during operations.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1486","description":"BlackByte has encrypted victim files for ransom. Early versions of BlackByte ransomware used a common key for encryption, but later versions use unique keys per victim.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"},{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"},{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1490","description":"BlackByte resized and deleted volume shadow copy files to prevent system recovery after encryption.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}]},{"technique_id":"T1491.001","description":"BlackByte left ransom notes in all directories where encryption takes place.","sources":[{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1505.003","description":"BlackByte has used ASPX web shells following exploitation of vulnerabilities in services such as Microsoft Exchange.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1518.001","description":"BlackByte enumerated installed security products during operations.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1543.003","description":"BlackByte modified multiple services on victim machines to enable encryption operations. BlackByte has installed tools such as AnyDesk as a service on victim machines.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"},{"source":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}]},{"technique_id":"T1547.001","description":"BlackByte has used Registry Run keys for persistence.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1560","description":"BlackByte compressed data collected from victim environments prior to exfiltration.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"}]},{"technique_id":"T1567","description":"BlackByte has used services such as anonymfiles.com and file.io to exfiltrate victim data.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"}]},{"technique_id":"T1569.002","description":"BlackByte created malicious services for ransomware execution.","sources":[{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"},{"source":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}]},{"technique_id":"T1570","description":"BlackByte transfered tools such as Cobalt Strike and the AnyDesk remote access tool during operations using SMB shares.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"}]},{"technique_id":"T1583.003","description":"BlackByte staged encryption keys on virtual private servers operated by the adversary.","sources":[{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1608.001","description":"BlackByte has staged tools such as Cobalt Strike at public file sharing and hosting sites.","sources":[{"source":"Microsoft BlackByte 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/07/06/the-five-day-job-a-blackbyte-ransomware-intrusion-case-study/"}]},{"technique_id":"T1614.001","description":"BlackByte identified system language settings to determine follow-on execution.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"}]},{"technique_id":"T1685","description":"BlackByte disabled security tools such as Windows Defender and the Raccine anti-ransomware tool during operations.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Cisco BlackByte 2024","url":"https://blog.talosintelligence.com/blackbyte-blends-tried-and-true-tradecraft-with-newly-disclosed-vulnerabilities-to-support-ongoing-attacks/"},{"source":"FBI BlackByte 2022","url":"https://www.ic3.gov/CSA/2022/220211.pdf"}]},{"technique_id":"T1686","description":"BlackByte modified firewall rules on victim machines to enable remote system discovery.","sources":[{"source":"Picus BlackByte 2022","url":"https://www.picussecurity.com/resource/ttps-used-by-blackbyte-ransomware-targeting-critical-infrastructure"},{"source":"Symantec BlackByte 2022","url":"https://www.security.com/threat-intelligence/blackbyte-exbyte-ransomware"}]}]},{"id":"G0063","name":"BlackOasis","procedures":[{"technique_id":"T1027","description":"BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.","sources":[{"source":"Securelist BlackOasis Oct 2017","url":"https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/"}]}]},{"id":"G0098","name":"BlackTech","procedures":[{"technique_id":"T1021.004","description":"BlackTech has used Putty for remote access.","sources":[{"source":"Symantec Palmerworm Sep 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt"}]},{"technique_id":"T1036.002","description":"BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.","sources":[{"source":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}]},{"technique_id":"T1046","description":"BlackTech has used the SNScan tool to find other potential targets on victim networks.","sources":[{"source":"Symantec Palmerworm Sep 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt"}]},{"technique_id":"T1106","description":"BlackTech has used built-in API functions.","sources":[{"source":"IronNet BlackTech Oct 2021","url":"https://www.ironnet.com/blog/china-cyber-attacks-the-current-threat-landscape"}]},{"technique_id":"T1190","description":"BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.","sources":[{"source":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}]},{"technique_id":"T1203","description":"BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.","sources":[{"source":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}]},{"technique_id":"T1204.001","description":"BlackTech has used e-mails with malicious links to lure victims into installing malware.","sources":[{"source":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}]},{"technique_id":"T1204.002","description":"BlackTech has used e-mails with malicious documents to lure victims into installing malware.","sources":[{"source":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"},{"source":"NTT Security Flagpro new December 2021","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}]},{"technique_id":"T1566.001","description":"BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.","sources":[{"source":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"},{"source":"NTT Security Flagpro new December 2021","url":"https://insight-jp.nttsecurity.com/post/102hf3q/flagpro-the-new-malware-used-by-blacktech"}]},{"technique_id":"T1566.002","description":"BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.","sources":[{"source":"TrendMicro BlackTech June 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/following-trail-blacktech-cyber-espionage-campaigns/"}]},{"technique_id":"T1574.001","description":"BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.","sources":[{"source":"Trend Micro Waterbear December 2019","url":"https://www.trendmicro.com/en_us/research/19/l/waterbear-is-back-uses-api-hooking-to-evade-security-product-detection.html"}]},{"technique_id":"T1588.002","description":"BlackTech has obtained and used tools such as Putty, SNScan, and PsExec for its operations.","sources":[{"source":"Symantec Palmerworm Sep 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt"}]},{"technique_id":"T1588.003","description":"BlackTech has used stolen code-signing certificates for its malicious payloads.","sources":[{"source":"Symantec Palmerworm Sep 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/palmerworm-blacktech-espionage-apt"}]},{"technique_id":"T1588.004","description":"BlackTech has used valid, stolen digital certificates for some of their malware and tools.","sources":[{"source":"ESET PLEAD Malware July 2018","url":"https://www.welivesecurity.com/2018/07/09/certificates-stolen-taiwanese-tech-companies-plead-malware-campaign/"}]}]},{"id":"G0108","name":"Blue Mockingbird","procedures":[{"technique_id":"T1003.001","description":"Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1021.001","description":"Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1021.002","description":"Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1027.013","description":"Blue Mockingbird has obfuscated the wallet address in the payload binary.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1036.005","description":"Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1047","description":"Blue Mockingbird has used wmic.exe to set environment variables.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1053.005","description":"Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1059.001","description":"Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1059.003","description":"Blue Mockingbird has used batch script files to automate execution and deployment of payloads.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1082","description":"Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1090","description":"Blue Mockingbird has used FRP, ssf, and Venom to establish SOCKS proxy connections.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1112","description":"Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1134","description":"Blue Mockingbird has used JuicyPotato to abuse the SeImpersonate token privilege to escalate from web application pool accounts to NT Authority\\SYSTEM.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1190","description":"Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1218.010","description":"Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1218.011","description":"Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1496.001","description":"Blue Mockingbird has used XMRIG to mine cryptocurrency on victim systems.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1543.003","description":"Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1546.003","description":"Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1569.002","description":"Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the \"wercplsupport\" service.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1574.012","description":"Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]},{"technique_id":"T1588.002","description":"Blue Mockingbird has obtained and used tools such as Mimikatz.","sources":[{"source":"RedCanary Mockingbird May 2020","url":"https://redcanary.com/blog/blue-mockingbird-cryptominer/"}]}]},{"id":"G0060","name":"BRONZE BUTLER","procedures":[{"technique_id":"T1003.001","description":"BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1005","description":"BRONZE BUTLER has exfiltrated files stolen from local systems.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1007","description":"BRONZE BUTLER has used TROJ_GETVERSION to discover system services.","sources":[{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1018","description":"BRONZE BUTLER typically use ping and Net to enumerate systems.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1027.001","description":"BRONZE BUTLER downloader code has included \"0\" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"},{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1027.003","description":"BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.","sources":[{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1036","description":"BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.","sources":[{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1036.002","description":"BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.","sources":[{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1036.005","description":"BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1039","description":"BRONZE BUTLER has exfiltrated files stolen from file shares.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1053.002","description":"BRONZE BUTLER has used at to register a scheduled task to execute malware during lateral movement.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1053.005","description":"BRONZE BUTLER has used schtasks to register a scheduled task to execute malware during lateral movement.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1059.001","description":"BRONZE BUTLER has used PowerShell for execution.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1059.003","description":"BRONZE BUTLER has used batch scripts and the command-line interface for execution.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1059.005","description":"BRONZE BUTLER has used VBS and VBE scripts for execution.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"},{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1059.006","description":"BRONZE BUTLER has made use of Python-based remote access tools.","sources":[{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1070.004","description":"The BRONZE BUTLER uploader or malware the uploader uses command to delete the RAR archives after they have been exfiltrated.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1071.001","description":"BRONZE BUTLER malware has used HTTP for C2.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1080","description":"BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1083","description":"BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1087.002","description":"BRONZE BUTLER has used net user /domain to identify account information.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1102.001","description":"BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1105","description":"BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1113","description":"BRONZE BUTLER has used a tool to capture screenshots.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"},{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1124","description":"BRONZE BUTLER has used net time to check the local time on a target system.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1132.001","description":"Several BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1140","description":"BRONZE BUTLER downloads encoded payloads and decodes them on the victim.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1189","description":"BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.","sources":[{"source":"Symantec Tick Apr 2016","url":"https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"}]},{"technique_id":"T1203","description":"BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.","sources":[{"source":"Symantec Tick Apr 2016","url":"https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"},{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1204.002","description":"BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.","sources":[{"source":"Symantec Tick Apr 2016","url":"https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"},{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1518","description":"BRONZE BUTLER has used tools to enumerate software installed on an infected host.","sources":[{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1547.001","description":"BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1548.002","description":"BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"},{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1550.003","description":"BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1560.001","description":"BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"},{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1566.001","description":"BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.","sources":[{"source":"Symantec Tick Apr 2016","url":"https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"},{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1573.001","description":"BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic. BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.","sources":[{"source":"Secureworks BRONZE BUTLER Oct 2017","url":"https://www.secureworks.com/research/bronze-butler-targets-japanese-businesses"}]},{"technique_id":"T1574.001","description":"BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.","sources":[{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]},{"technique_id":"T1588.002","description":"BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.","sources":[{"source":"Symantec Tick Apr 2016","url":"https://www.symantec.com/connect/blogs/tick-cyberespionage-group-zeros-japan"}]},{"technique_id":"T1685","description":"BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.","sources":[{"source":"Trend Micro Tick November 2019","url":"https://documents.trendmicro.com/assets/pdf/Operation-ENDTRADE-TICK-s-Multi-Stage-Backdoors-for-Attacking-Industries-and-Stealing-Classified-Data.pdf"}]}]},{"id":"G0008","name":"Carbanak","procedures":[{"technique_id":"T1036.004","description":"Carbanak has copied legitimate service names to use for malicious services.","sources":[{"source":"Kaspersky Carbanak","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"}]},{"technique_id":"T1036.005","description":"Carbanak has named malware \"svchost.exe,\" which is the name of the Windows shared service host program.","sources":[{"source":"Kaspersky Carbanak","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"}]},{"technique_id":"T1078","description":"Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.","sources":[{"source":"Kaspersky Carbanak","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"}]},{"technique_id":"T1102.002","description":"Carbanak has used a VBScript named \"ggldr\" that uses Google Apps Script, Sheets, and Forms services for C2.","sources":[{"source":"Forcepoint Carbanak Google C2","url":"https://blogs.forcepoint.com/security-labs/carbanak-group-uses-google-malware-command-and-control"}]},{"technique_id":"T1218.011","description":"Carbanak installs VNC server software that executes through rundll32.","sources":[{"source":"Kaspersky Carbanak","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"}]},{"technique_id":"T1219","description":"Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.","sources":[]},{"technique_id":"T1543.003","description":"Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.","sources":[{"source":"Kaspersky Carbanak","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"}]},{"technique_id":"T1588.002","description":"Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.","sources":[{"source":"Kaspersky Carbanak","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf"}]},{"technique_id":"T1686","description":"Carbanak may use netsh to add local firewall rule exceptions.","sources":[]}]},{"id":"G0114","name":"Chimera","procedures":[{"technique_id":"T1003.003","description":"Chimera has gathered the SYSTEM registry and ntds.dit files from target systems. Chimera specifically has used the NtdsAudit tool to dump the password hashes of domain users via msadcs.exe \"NTDS.dit\" -s \"SYSTEM\" -p RecordedTV_pdmp.txt --users-csv RecordedTV_users.csv and used ntdsutil to copy the Active Directory database.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1007","description":"Chimera has used net start and net use for system service discovery.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1012","description":"Chimera has queried Registry keys using reg query \\\\\\HKU\\\\SOFTWARE\\Microsoft\\Terminal Server Client\\Servers and reg query \\\\\\HKU\\\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1016","description":"Chimera has used ipconfig, Ping, and tracert to enumerate the IP address and network environment and settings of the local host.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1018","description":"Chimera has utilized various scans and queries to find domain controllers and remote services in the target environment.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1021.001","description":"Chimera has used RDP to access targeted systems.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"}]},{"technique_id":"T1021.002","description":"Chimera has used Windows admin shares to move laterally.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1021.006","description":"Chimera has used WinRM for lateral movement.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1027.010","description":"Chimera has encoded PowerShell commands.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"}]},{"technique_id":"T1033","description":"Chimera has used the quser command to show currently logged on users.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1036.005","description":"Chimera has renamed malware to GoogleUpdate.exe and WinRAR to jucheck.exe, RecordedTV.ms, teredo.tmp, update.exe, and msadcs1.exe.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"}]},{"technique_id":"T1039","description":"Chimera has collected data of interest from network shares.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1041","description":"Chimera has used Cobalt Strike C2 beacons for data exfiltration.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1046","description":"Chimera has used the get -b -e -p command for network scanning as well as a custom Python tool packed into a Windows executable named Get.exe to scan IP ranges for HTTP.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1047","description":"Chimera has used WMIC to execute remote commands.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1049","description":"Chimera has used netstat -ano | findstr EST to discover network connections.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1053.005","description":"Chimera has used scheduled tasks to invoke Cobalt Strike including through batch script schtasks /create /ru \"SYSTEM\" /tn \"update\" /tr \"cmd /c c:\\windows\\temp\\update.bat\" /sc once /f /st and to maintain persistence.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1057","description":"Chimera has used tasklist to enumerate processes.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1059.001","description":"Chimera has used PowerShell scripts to execute malicious payloads and the DSInternals PowerShell module to make use of Active Directory features.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1059.003","description":"Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1069.001","description":"Chimera has used net localgroup administrators to identify accounts with local administrative rights.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1070.004","description":"Chimera has performed file deletion to evade detection.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"}]},{"technique_id":"T1070.006","description":"Chimera has used a Windows version of the Linux touch command to modify the date and time stamp on DLLs.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1071.001","description":"Chimera has used HTTPS for C2 communications.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1071.004","description":"Chimera has used Cobalt Strike to encapsulate C2 in DNS traffic.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1074.001","description":"Chimera has staged stolen data locally on compromised hosts.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1074.002","description":"Chimera has staged stolen data on designated servers in the target environment.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1078","description":"Chimera has used a valid account to maintain persistence via scheduled task.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"}]},{"technique_id":"T1078.002","description":"Chimera has used compromised domain accounts to gain access to the target environment.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1083","description":"Chimera has utilized multiple commands to identify data of interest in file and directory listings.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1087.001","description":"Chimera has used net user for account discovery.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1087.002","description":"Chimera has has used net user /dom and net user Administrator to enumerate domain accounts including administrator accounts.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1105","description":"Chimera has remotely copied tools and malware onto targeted systems.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"}]},{"technique_id":"T1106","description":"Chimera has used direct Windows system calls by leveraging Dumpert.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"}]},{"technique_id":"T1110.003","description":"Chimera has used multiple password spraying attacks against victim's remote services to obtain valid user and administrator accounts.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1110.004","description":"Chimera has used credential stuffing against victim's remote services to obtain valid accounts.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1111","description":"Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1114.001","description":"Chimera has harvested data from victim's e-mail including through execution of wmic /node: process call create \"cmd /c copy c:\\Users\\\\\\backup.pst c:\\windows\\temp\\backup.pst\" copy \"i:\\\\\\My Documents\\.pst\" copy.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1114.002","description":"Chimera has harvested data from remote mailboxes including through execution of \\\\\\c$\\Users\\\\AppData\\Local\\Microsoft\\Outlook*.ost.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1119","description":"Chimera has used custom DLLs for continuous retrieval of data from memory.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1124","description":"Chimera has used time /t and net time \\\\ip/hostname for system time discovery.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1133","description":"Chimera has used legitimate credentials to login to an external VPN, Citrix, SSH, and other remote services.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1135","description":"Chimera has used net share and net view to identify network shares of interest.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1201","description":"Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1213.002","description":"Chimera has collected documents from the victim's SharePoint.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1217","description":"Chimera has used type \\\\\\c$\\Users\\\\Favorites\\Links\\Bookmarks bar\\Imported From IE\\*citrix* for bookmark discovery.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1482","description":"Chimera has nltest /domain_trusts to identify domain trust relationships.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1550.002","description":"Chimera has dumped password hashes for use in pass the hash authentication attacks.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1556.001","description":"Chimera's malware has altered the NTLM authentication program on domain controllers to allow Chimera to login without a valid credential.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"}]},{"technique_id":"T1560.001","description":"Chimera has used gzip for Linux OS and a modified RAR software to archive data on Windows hosts.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1567.002","description":"Chimera has exfiltrated stolen data to OneDrive accounts.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1569.002","description":"Chimera has used PsExec to deploy beacons on compromised systems.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1570","description":"Chimera has copied tools between compromised hosts using SMB.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1572","description":"Chimera has encapsulated Cobalt Strike's C2 protocol in DNS and HTTPS.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1574.001","description":"Chimera has used side loading to place malicious DLLs in memory.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1588.002","description":"Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.","sources":[{"source":"Cycraft Chimera April 2020","url":"https://web.archive.org/web/20231214094657/https://cycraft.com/download/CyCraft-Whitepaper-Chimera_V4.1.pdf"},{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1589.001","description":"Chimera has collected credentials for the target organization from previous breaches for use in brute force attacks.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1680","description":"Chimera has used fsutil fsinfo drives, systeminfo, and vssadmin list shadows for system information including shadow volumes and drive information.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]},{"technique_id":"T1685.005","description":"Chimera has cleared event logs on compromised hosts.","sources":[{"source":"NCC Group Chimera January 2021","url":"https://web.archive.org/web/20230218064220/https://research.nccgroup.com/2021/01/12/abusing-cloud-services-to-fly-under-the-radar/"}]}]},{"id":"G1021","name":"Cinnamon Tempest","procedures":[{"technique_id":"T1021.002","description":"Cinnamon Tempest has used SMBexec for lateral movement.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"technique_id":"T1047","description":"Cinnamon Tempest has used Impacket for lateral movement via WMI.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"},{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1059.001","description":"Cinnamon Tempest has used PowerShell to communicate with C2, download files, and execute reconnaissance commands.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"technique_id":"T1059.003","description":"Cinnamon Tempest has executed ransomware using batch scripts deployed via GPO.","sources":[{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1059.006","description":"Cinnamon Tempest has used a customized version of the Impacket wmiexec.py module to create renamed output files.","sources":[{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1078","description":"Cinnamon Tempest has used compromised user accounts to deploy payloads and create system services.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"technique_id":"T1078.002","description":"Cinnamon Tempest has obtained highly privileged credentials such as domain administrator in order to deploy malware.","sources":[{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1080","description":"Cinnamon Tempest has deployed ransomware from a batch file in a network share.","sources":[{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1090","description":"Cinnamon Tempest has used a customized version of the Iox port-forwarding and proxy tool.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"technique_id":"T1105","description":"Cinnamon Tempest has downloaded files, including Cobalt Strike, to compromised hosts.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"technique_id":"T1140","description":"Cinnamon Tempest has used weaponized DLLs to load and decrypt payloads.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"technique_id":"T1190","description":"Cinnamon Tempest has exploited multiple unpatched vulnerabilities for initial access including vulnerabilities in Microsoft Exchange, Manage Engine AdSelfService Plus, Confluence, and Log4j.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"},{"source":"SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022","url":"https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"},{"source":"Microsoft Log4j Vulnerability Exploitation December 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/"},{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1484.001","description":"Cinnamon Tempest has used Group Policy to deploy batch scripts for ransomware deployment.","sources":[{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1543.003","description":"Cinnamon Tempest has created system services to establish persistence for deployed tooling.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"technique_id":"T1567.002","description":"Cinnamon Tempest has uploaded captured keystroke logs to the Alibaba Cloud Object Storage Service, Aliyun OSS.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"technique_id":"T1572","description":"Cinnamon Tempest has used the Iox and NPS proxy and tunneling tools in combination create multiple connections through a single tunnel.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"}]},{"technique_id":"T1574.001","description":"Cinnamon Tempest has used search order hijacking to launch Cobalt Strike Beacons. Cinnamon Tempest has also abused legitimate executables to side-load weaponized DLLs.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"},{"source":"SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022","url":"https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"},{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1588.002","description":"Cinnamon Tempest has used open-source tools including customized versions of the Iox proxy tool, NPS tunneling tool, Meterpreter, and a keylogger that uploads data to Alibaba cloud storage.","sources":[{"source":"Sygnia Emperor Dragonfly October 2022","url":"https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"},{"source":"SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022","url":"https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"}]},{"technique_id":"T1657","description":"Cinnamon Tempest has maintained leak sites for exfiltrated data in attempt to extort victims into paying a ransom.","sources":[{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]}]},{"id":"G0003","name":"Cleaver","procedures":[{"technique_id":"T1003.001","description":"Cleaver has been known to dump credentials using Mimikatz and Windows Credential Editor.","sources":[{"source":"Cylance Cleaver","url":"https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"}]},{"technique_id":"T1557.002","description":"Cleaver has used custom tools to facilitate ARP cache poisoning.","sources":[{"source":"Cylance Cleaver","url":"https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"}]},{"technique_id":"T1585.001","description":"Cleaver has created fake LinkedIn profiles that included profile photos, details, and connections.","sources":[]},{"technique_id":"T1587.001","description":"Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.","sources":[{"source":"Cylance Cleaver","url":"https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"}]},{"technique_id":"T1588.002","description":"Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.","sources":[{"source":"Cylance Cleaver","url":"https://web.archive.org/web/20200302085133/https://www.cylance.com/content/dam/cylance/pages/operation-cleaver/Cylance_Operation_Cleaver_Report.pdf"}]}]},{"id":"G0080","name":"Cobalt Group","procedures":[{"technique_id":"T1021.001","description":"Cobalt Group has used Remote Desktop Protocol to conduct lateral movement.","sources":[{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1027.010","description":"Cobalt Group obfuscated several scriptlets and code used on the victim’s machine, including through use of XOR and RC4.","sources":[{"source":"Morphisec Cobalt Gang Oct 2018","url":"https://blog.morphisec.com/cobalt-gang-2.0"},{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"}]},{"technique_id":"T1037.001","description":"Cobalt Group has added persistence by registering the file name for the next stage malware under HKCU\\Environment\\UserInitMprLogonScript.","sources":[{"source":"Morphisec Cobalt Gang Oct 2018","url":"https://blog.morphisec.com/cobalt-gang-2.0"}]},{"technique_id":"T1046","description":"Cobalt Group leveraged an open-source tool called SoftPerfect Network Scanner to perform network scanning.","sources":[{"source":"PTSecurity Cobalt Group Aug 2017","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1053.005","description":"Cobalt Group has created Windows tasks to establish persistence.","sources":[{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1055","description":"Cobalt Group has injected code into trusted processes.","sources":[{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1059.001","description":"Cobalt Group has used powershell.exe to download and execute scripts.","sources":[{"source":"TrendMicro Cobalt Group Nov 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"},{"source":"RiskIQ Cobalt Jan 2018","url":"https://web.archive.org/web/20190508170147/https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/"},{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"},{"source":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source":"PTSecurity Cobalt Group Aug 2017","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"}]},{"technique_id":"T1059.003","description":"Cobalt Group has used a JavaScript backdoor that is capable of launching cmd.exe to execute shell commands. The group has used an exploit toolkit known as Threadkit that launches .bat files.","sources":[{"source":"Morphisec Cobalt Gang Oct 2018","url":"https://blog.morphisec.com/cobalt-gang-2.0"},{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"PTSecurity Cobalt Group Aug 2017","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"},{"source":"Unit 42 Cobalt Gang Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"},{"source":"TrendMicro Cobalt Group Nov 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"}]},{"technique_id":"T1059.005","description":"Cobalt Group has sent Word OLE compound documents with malicious obfuscated VBA macros that will run upon user execution.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"PTSecurity Cobalt Group Aug 2017","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"},{"source":"Morphisec Cobalt Gang Oct 2018","url":"https://blog.morphisec.com/cobalt-gang-2.0"},{"source":"Unit 42 Cobalt Gang Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"},{"source":"TrendMicro Cobalt Group Nov 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"}]},{"technique_id":"T1059.007","description":"Cobalt Group has executed JavaScript scriptlets on the victim's machine.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"PTSecurity Cobalt Group Aug 2017","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"},{"source":"Morphisec Cobalt Gang Oct 2018","url":"https://blog.morphisec.com/cobalt-gang-2.0"},{"source":"Unit 42 Cobalt Gang Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"},{"source":"TrendMicro Cobalt Group Nov 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"}]},{"technique_id":"T1068","description":"Cobalt Group has used exploits to increase their levels of rights and privileges.","sources":[{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1070.004","description":"Cobalt Group deleted the DLL dropper from the victim’s machine to cover their tracks.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"}]},{"technique_id":"T1071.001","description":"Cobalt Group has used HTTPS for C2.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1071.004","description":"Cobalt Group has used DNS tunneling for C2.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1105","description":"Cobalt Group has used public sites such as github.com and sendspace.com to upload files and then download them to victim computers. The group's JavaScript backdoor is also capable of downloading files.","sources":[{"source":"PTSecurity Cobalt Group Aug 2017","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source":"Morphisec Cobalt Gang Oct 2018","url":"https://blog.morphisec.com/cobalt-gang-2.0"}]},{"technique_id":"T1195.002","description":"Cobalt Group has compromised legitimate web browser updates to deliver a backdoor.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"}]},{"technique_id":"T1203","description":"Cobalt Group had exploited multiple vulnerabilities for execution, including Microsoft’s Equation Editor (CVE-2017-11882), an Internet Explorer vulnerability (CVE-2018-8174), CVE-2017-8570, CVE-2017-0199, and CVE-2017-8759.","sources":[{"source":"Crowdstrike Global Threat Report Feb 2018","url":"https://crowdstrike.lookbookhq.com/global-threat-report-2018-web/cs-2018-global-threat-report"},{"source":"TrendMicro Cobalt Group Nov 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"},{"source":"RiskIQ Cobalt Nov 2017","url":"https://web.archive.org/web/20190508170630/https://www.riskiq.com/blog/labs/cobalt-strike/"},{"source":"RiskIQ Cobalt Jan 2018","url":"https://web.archive.org/web/20190508170147/https://www.riskiq.com/blog/labs/cobalt-group-spear-phishing-russian-banks/"},{"source":"Proofpoint Cobalt June 2017","url":"https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target"},{"source":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source":"PTSecurity Cobalt Group Aug 2017","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"}]},{"technique_id":"T1204.001","description":"Cobalt Group has sent emails containing malicious links that require users to execute a file or macro to infect the victim machine.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"Unit 42 Cobalt Gang Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"},{"source":"Secureworks GOLD KINGSWOOD September 2018","url":"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"}]},{"technique_id":"T1204.002","description":"Cobalt Group has sent emails containing malicious attachments that require users to execute a file or macro to infect the victim machine.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"Unit 42 Cobalt Gang Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"}]},{"technique_id":"T1218.003","description":"Cobalt Group has used the command cmstp.exe /s /ns C:\\Users\\ADMINI~W\\AppData\\Local\\Temp\\XKNqbpzl.txt to bypass AppLocker and launch a malicious script.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"Morphisec Cobalt Gang Oct 2018","url":"https://blog.morphisec.com/cobalt-gang-2.0"},{"source":"Unit 42 Cobalt Gang Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"}]},{"technique_id":"T1218.008","description":"Cobalt Group has used odbcconf to proxy the execution of malicious DLL files.","sources":[{"source":"TrendMicro Cobalt Group Nov 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"}]},{"technique_id":"T1218.010","description":"Cobalt Group has used regsvr32.exe to execute scripts.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"Morphisec Cobalt Gang Oct 2018","url":"https://blog.morphisec.com/cobalt-gang-2.0"},{"source":"TrendMicro Cobalt Group Nov 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"}]},{"technique_id":"T1219","description":"Cobalt Group used the Ammyy Admin tool as well as TeamViewer for remote access, including to preserve remote access if a Cobalt Strike module was lost.","sources":[{"source":"PTSecurity Cobalt Group Aug 2017","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1220","description":"Cobalt Group used msxsl.exe to bypass AppLocker and to invoke Jscript code from an XSL file.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"}]},{"technique_id":"T1518.001","description":"Cobalt Group used a JavaScript backdoor that is capable of collecting a list of the security solutions installed on the victim's machine.","sources":[{"source":"Morphisec Cobalt Gang Oct 2018","url":"https://blog.morphisec.com/cobalt-gang-2.0"}]},{"technique_id":"T1543.003","description":"Cobalt Group has created new services to establish persistence.","sources":[{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1547.001","description":"Cobalt Group has used Registry Run keys for persistence. The group has also set a Startup path to launch the PowerShell shell command and download Cobalt Strike.","sources":[{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1548.002","description":"Cobalt Group has bypassed UAC.","sources":[{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1559.002","description":"Cobalt Group has sent malicious Word OLE compound documents to victims.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"}]},{"technique_id":"T1566.001","description":"Cobalt Group has sent spearphishing emails with various attachment types to corporate and personal email accounts of victim organizations. Attachment types have included .rtf, .doc, .xls, archives containing LNK files, and password protected archives containing .exe and .scr executables.","sources":[{"source":"TrendMicro Cobalt Group Nov 2017","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/cobalt-spam-runs-use-macros-cve-2017-8759-exploit/"},{"source":"RiskIQ Cobalt Nov 2017","url":"https://web.archive.org/web/20190508170630/https://www.riskiq.com/blog/labs/cobalt-strike/"},{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"},{"source":"Proofpoint Cobalt June 2017","url":"https://www.proofpoint.com/us/threat-insight/post/microsoft-word-intruder-integrates-cve-2017-0199-utilized-cobalt-group-target"},{"source":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source":"PTSecurity Cobalt Group Aug 2017","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-2017-eng.pdf"},{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"Unit 42 Cobalt Gang Oct 2018","url":"https://researchcenter.paloaltonetworks.com/2018/10/unit42-new-techniques-uncover-attribute-cobalt-gang-commodity-builders-infrastructure-revealed/"}]},{"technique_id":"T1566.002","description":"Cobalt Group has sent emails with URLs pointing to malicious documents.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"Secureworks GOLD KINGSWOOD September 2018","url":"https://www.secureworks.com/blog/cybercriminals-increasingly-trying-to-ensnare-the-big-financial-fish"}]},{"technique_id":"T1572","description":"Cobalt Group has used the Plink utility to create SSH tunnels.","sources":[{"source":"Talos Cobalt Group July 2018","url":"https://blog.talosintelligence.com/2018/07/multiple-cobalt-personality-disorder.html"},{"source":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"},{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1573.002","description":"Cobalt Group has used the Plink utility to create SSH tunnels.","sources":[{"source":"Group IB Cobalt Aug 2017","url":"https://www.group-ib.com/blog/cobalt"}]},{"technique_id":"T1588.002","description":"Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.","sources":[{"source":"PTSecurity Cobalt Dec 2016","url":"https://www.ptsecurity.com/upload/corporate/ww-en/analytics/Cobalt-Snatch-eng.pdf"}]}]},{"id":"G0142","name":"Confucius","procedures":[{"technique_id":"T1041","description":"Confucius has exfiltrated stolen files to its C2 server.","sources":[{"source":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}]},{"technique_id":"T1053.005","description":"Confucius has created scheduled tasks to maintain persistence on a compromised host.","sources":[{"source":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}]},{"technique_id":"T1059.001","description":"Confucius has used PowerShell to execute malicious files and payloads.","sources":[{"source":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}]},{"technique_id":"T1059.005","description":"Confucius has used VBScript to execute malicious code.","sources":[{"source":"TrendMicro Confucius APT Feb 2018","url":"https://www.trendmicro.com/en_us/research/18/b/deciphering-confucius-cyberespionage-operations.html"}]},{"technique_id":"T1071.001","description":"Confucius has used HTTP for C2 communications.","sources":[{"source":"Uptycs Confucius APT Jan 2021","url":"https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"}]},{"technique_id":"T1083","description":"Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.","sources":[{"source":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}]},{"technique_id":"T1105","description":"Confucius has downloaded additional files and payloads onto a compromised host following initial access.","sources":[{"source":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"},{"source":"Uptycs Confucius APT Jan 2021","url":"https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"}]},{"technique_id":"T1119","description":"Confucius has used a file stealer to steal documents and images with the following extensions: txt, pdf, png, jpg, doc, xls, xlm, odp, ods, odt, rtf, ppt, xlsx, xlsm, docx, pptx, and jpeg.","sources":[{"source":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}]},{"technique_id":"T1203","description":"Confucius has exploited Microsoft Office vulnerabilities, including CVE-2015-1641, CVE-2017-11882, and CVE-2018-0802.","sources":[{"source":"TrendMicro Confucius APT Feb 2018","url":"https://www.trendmicro.com/en_us/research/18/b/deciphering-confucius-cyberespionage-operations.html"},{"source":"Uptycs Confucius APT Jan 2021","url":"https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"}]},{"technique_id":"T1204.001","description":"Confucius has lured victims into clicking on a malicious link sent through spearphishing.","sources":[{"source":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}]},{"technique_id":"T1204.002","description":"Confucius has lured victims to execute malicious attachments included in crafted spearphishing emails related to current topics.","sources":[{"source":"Uptycs Confucius APT Jan 2021","url":"https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"}]},{"technique_id":"T1218.005","description":"Confucius has used mshta.exe to execute malicious VBScript.","sources":[{"source":"TrendMicro Confucius APT Feb 2018","url":"https://www.trendmicro.com/en_us/research/18/b/deciphering-confucius-cyberespionage-operations.html"}]},{"technique_id":"T1221","description":"Confucius has used a weaponized Microsoft Word document with an embedded RTF exploit.","sources":[{"source":"Uptycs Confucius APT Jan 2021","url":"https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"}]},{"technique_id":"T1547.001","description":"Confucius has dropped malicious files into the startup folder %AppData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup on a compromised host in order to maintain persistence.","sources":[{"source":"Uptycs Confucius APT Jan 2021","url":"https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"}]},{"technique_id":"T1566.001","description":"Confucius has crafted and sent victims malicious attachments to gain initial access.","sources":[{"source":"Uptycs Confucius APT Jan 2021","url":"https://www.uptycs.com/blog/confucius-apt-deploys-warzone-rat"}]},{"technique_id":"T1566.002","description":"Confucius has sent malicious links to victims through email campaigns.","sources":[{"source":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}]},{"technique_id":"T1567.002","description":"Confucius has exfiltrated victim data to cloud storage service accounts.","sources":[{"source":"TrendMicro Confucius APT Feb 2018","url":"https://www.trendmicro.com/en_us/research/18/b/deciphering-confucius-cyberespionage-operations.html"}]},{"technique_id":"T1583.006","description":"Confucius has obtained cloud storage service accounts to host stolen data.","sources":[{"source":"TrendMicro Confucius APT Feb 2018","url":"https://www.trendmicro.com/en_us/research/18/b/deciphering-confucius-cyberespionage-operations.html"}]},{"technique_id":"T1680","description":"Confucius has used a file stealer that can examine system drives, including those other than the C drive.","sources":[{"source":"TrendMicro Confucius APT Aug 2021","url":"https://www.trendmicro.com/en_us/research/21/h/confucius-uses-pegasus-spyware-related-lures-to-target-pakistani.html"}]}]},{"id":"G1052","name":"Contagious Interview","procedures":[{"technique_id":"T1027.010","description":"Contagious Interview has obfuscated JavaScript code using Base64 and variable substitutions.","sources":[{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source":"Securonix Contagious Interview DEVPOPPER April 2024","url":"https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/"},{"source":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"}]},{"technique_id":"T1027.013","description":"Contagious Interview has used hexadecimal string encoding to hide critical JavaScript module names, function names, and C2 URLs, which are decoded dynamically at runtime.","sources":[{"source":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"}]},{"technique_id":"T1036","description":"Contagious Interview has delivered BeaverTail malware masquerading as legitimate software or applications. Contagious Interview has also delivered malicious payloads masquerading as legitimate software drivers.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"},{"source":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1041","description":"Contagious Interview has exfiltrated data from a compromised host to actor-controlled C2 servers.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1048.003","description":"Contagious Interview has exfiltrated victim information using FTP.","sources":[{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1059.003","description":"Contagious Interview has utilized VBS scripts to open cmd.exe and run commands to include the go_batch.bat batch file.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"}]},{"technique_id":"T1059.004","description":"Contagious Interview has targeted macOS victim hosts using a bash downloader coremedia.sh and a bash script cloud.sh.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"}]},{"technique_id":"T1059.005","description":"Contagious Interview has utilized Visual Basic scripts in the execution of their downloader malware targeting Windows devices including as script called update.vbs.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"}]},{"technique_id":"T1059.006","description":"Contagious Interview has used the Python-based malware such as InvisibleFerret to install and execute Python Packages and Python modules.","sources":[{"source":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"technique_id":"T1059.007","description":"Contagious Interview has leveraged JavaScript in the execution of their downloader malware targeting Windows devices using a NodeJS script titled nvidia.js.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"}]},{"technique_id":"T1070.004","description":"Contagious Interview has configured malware to remove archives used in collection activities following successful exfiltration.","sources":[{"source":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"}]},{"technique_id":"T1071.003","description":"Contagious Interview has utilized email notifications from malware distribution servers to track victim engagement.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"}]},{"technique_id":"T1082","description":"Contagious Interview has configured malicious webpages to identify the victim’s operating system by reviewing the details of the victims User-Agent of their browser.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"}]},{"technique_id":"T1083","description":"Contagious Interview has conducted key word searches within files and directories on a compromised hosts to identify files for exfiltration.","sources":[{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"technique_id":"T1090","description":"Contagious Interview has leveraged Astrill VPN for C2.","sources":[{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"}]},{"technique_id":"T1204.001","description":"Contagious Interview has lured victims to click on a malicious link that led to download of a malicious payload. Contagious Interview has also leveraged links to malicious payloads on social media and code repositories.","sources":[{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"}]},{"technique_id":"T1204.002","description":"Contagious Interview has distributed malicious files requiring direct victim interaction to execute through the guise of a code test.","sources":[{"source":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source":"SecurityScorecard Contagious Interview FamousChollima October 2024","url":"https://securityscorecard.com/blog/the-job-offer-that-wasnt-how-we-stopped-an-espionage-plot/"}]},{"technique_id":"T1204.004","description":"Contagious Interview has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"},{"source":"Validin Contagious Interview North Korea ClickFix January 2025","url":"https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"}]},{"technique_id":"T1204.005","description":"Contagious Interview has relied on users to install a malicious library from a code repository to infect the victim's device and has led to additional payload distribution and theft of sensitive data.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Validin Contagious Interview North Korea ClickFix January 2025","url":"https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"},{"source":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"Securonix Contagious Interview DEVPOPPER April 2024","url":"https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/"},{"source":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"technique_id":"T1219.002","description":"Contagious Interview has downloaded remote management and monitoring software such as “AnyDesk” for post compromise activities.","sources":[{"source":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1480","description":"Contagious Interview has configured C2 endpoints to review IP geolocation, request headers, victim environment details and runtime conditions prior to delivering payloads.","sources":[{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]},{"technique_id":"T1497","description":"Contagious Interview has requested victims to disable Docker and other container environments in attempts to thwart container isolation and ensure device infection.","sources":[{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]},{"technique_id":"T1543.001","description":"Contagious Interview has established persistence using InvisibleFerret malware to create file to run the script on Startup via LaunchAgents. Contagious Interview has also utilized a plist file located in /Library/LaunchAgents to enable a malicious bash script the ability to persist.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"},{"source":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"}]},{"technique_id":"T1546.004","description":"Contagious Interview has targeted macOS victim hosts using a bash downloader coremedia.sh and a bash script cloud.sh.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"}]},{"technique_id":"T1547.001","description":"Contagious Interview has established persistence using InvisibleFerret malware to place a .bat file in the Startup Folder.","sources":[{"source":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"}]},{"technique_id":"T1547.013","description":"Contagious Interview has established persistence using InvisibleFerret malware to create a .desktop entry to run on startup on GNOME-based Linux devices.","sources":[{"source":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"}]},{"technique_id":"T1555.001","description":"Contagious Interview has leveraged malware variants configured to dump credentials from the macOS keychain.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"},{"source":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]},{"technique_id":"T1566.003","description":"Contagious Interview has used fake job advertisements and messages sent via social media to spearphish targets. Contagious Interview has also leveraged hiring websites to solicit victims.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"},{"source":"Validin Contagious Interview North Korea ClickFix January 2025","url":"https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"},{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source":"SecurityScorecard Contagious Interview FamousChollima October 2024","url":"https://securityscorecard.com/blog/the-job-offer-that-wasnt-how-we-stopped-an-espionage-plot/"}]},{"technique_id":"T1567","description":"Contagious Interview has leveraged Telegram API to exfiltrate stolen data.","sources":[{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"}]},{"technique_id":"T1567.002","description":"Contagious Interview has exfiltrated stolen passwords to Dropbox.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"}]},{"technique_id":"T1571","description":"Contagious Interview has used TCP port 1224 for C2.","sources":[{"source":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"}]},{"technique_id":"T1573.001","description":"Contagious Interview has encrypted C2 traffic using RC4.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"}]},{"technique_id":"T1583","description":"Contagious Interview has used services such as Astrill VPN.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"}]},{"technique_id":"T1583.001","description":"Contagious Interview has registered domains to leverage in their social engineering campaigns. Contagious Interview has also registered domains to utilize for C2.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"},{"source":"Validin Contagious Interview North Korea ClickFix January 2025","url":"https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"},{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1583.003","description":"Contagious Interview has acquired virtual private servers from services such as Stark Industries Solutions and RouterHosting. Contagious Interview has also utilized hosting providers to include Tier[.]Net, Majestic Hosting, Leaseweb Singapore, and Kaopu Cloud.","sources":[{"source":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"technique_id":"T1583.006","description":"Contagious Interview has used web services such as Dropbox to receive stolen data and Google Drive, Firebase, GitHub, and Telegram to disseminate files. Contagious Interview has also used a cloud platform such as Vercel for C2 operations leveraging malicious web applications and static pages. Contagious Interview has also used Slack to coordinate their activities.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"},{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]},{"technique_id":"T1585","description":"Contagious Interview has created and maintained personas on code repositories to distribute malicious payloads.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Validin Contagious Interview North Korea ClickFix January 2025","url":"https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"},{"source":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"}]},{"technique_id":"T1585.001","description":"Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.","sources":[{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source":"SecurityScorecard Contagious Interview FamousChollima October 2024","url":"https://securityscorecard.com/blog/the-job-offer-that-wasnt-how-we-stopped-an-espionage-plot/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1585.002","description":"Contagious Interview has created fake email accounts to correspond with social media accounts, fake LinkedIn personas, code repository accounts, and job announcements on development job board services. Contagious Interview has also utilized fake email accounts with Threat Intelligence vendor services.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1587","description":"Contagious Interview developed malicious NPM packages for delivery to or retrieval by victims.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Validin Contagious Interview North Korea ClickFix January 2025","url":"https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"},{"source":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"technique_id":"T1587.001","description":"Contagious Interview has developed malware that utilizes Qt cross-platform framework to include BeaverTail.","sources":[{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1588.002","description":"Contagious Interview has used remote management and monitoring software such as “AnyDesk”.","sources":[{"source":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1588.007","description":"Contagious Interview has appeared to have used AI to generate images and content to facilitate their campaigns.","sources":[{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"}]},{"technique_id":"T1589","description":"Contagious Interview has researched specific professional groups such as software developers for targeting. Contagious Interview has also researched individuals who work in roles related to cryptocurrency and blockchain technologies.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source":"Securonix Contagious Interview DEVPOPPER April 2024","url":"https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/"},{"source":"SecurityScorecard Contagious Interview FamousChollima October 2024","url":"https://securityscorecard.com/blog/the-job-offer-that-wasnt-how-we-stopped-an-espionage-plot/"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1593","description":"Contagious Interview has utilized open-source indicator of compromise repositories to determine their exposure to include VirusTotal, and MalTrail.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"}]},{"technique_id":"T1593.001","description":"Contagious Interview had identified and solicited victims through social media such as LinkedIn, X, and Telegram.","sources":[{"source":"Sekoia ClickFake 2025","url":"https://blog.sekoia.io/clickfake-interview-campaign-by-lazarus/"},{"source":"Validin Contagious Interview North Korea ClickFix January 2025","url":"https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"},{"source":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source":"SecurityScorecard Contagious Interview FamousChollima October 2024","url":"https://securityscorecard.com/blog/the-job-offer-that-wasnt-how-we-stopped-an-espionage-plot/"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1593.003","description":"Contagious Interview had identified and solicited victims through code repositories such as GitHub.","sources":[{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"technique_id":"T1608.001","description":"Contagious Interview has hosted malicious payloads on code repositories used as lures for victims to download.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Validin Contagious Interview North Korea ClickFix January 2025","url":"https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"},{"source":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source":"Recorded Future Contagious Inteview BeaverTail InvisibleFerret OtterCookie February 2025","url":"https://www.recordedfuture.com/research/inside-the-scam-north-koreas-it-worker-threat"},{"source":"Socket Contagious Interview NPM April 2025","url":"https://socket.dev/blog/lazarus-expands-malicious-npm-campaign-11-new-packages-add-malware-loaders-and-bitbucket"},{"source":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source":"Securonix Contagious Interview DEVPOPPER April 2024","url":"https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/"},{"source":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"}]},{"technique_id":"T1657","description":"Contagious Interview has stolen cryptocurrency wallet credentials and credit card information utilizing BeaverTail and InvisibleFerret malware.","sources":[{"source":"Esentire ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.esentire.com/blog/bored-beavertail-invisibleferret-yacht-club-a-lazarus-lure-pt-2"},{"source":"Socket BeaverTail XORIndex HexEval Contagious Interview July 2025","url":"https://socket.dev/blog/contagious-interview-campaign-escalates-67-malicious-npm-packages"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"},{"source":"Zscaler ContagiousInterview BeaverTail InvisibleFerret November 2024","url":"https://www.zscaler.com/blogs/security-research/pyongyang-your-payroll-rise-north-korean-remote-workers-west"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1681","description":"Contagious Interview has registered accounts with Threat Intelligence vendor services to check for reporting associated with their infrastructure and to evaluate new potential infrastructure.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"}]},{"technique_id":"T1683.001","description":"Contagious Interview has created fake social media accounts such as LinkedIn and Telegram accounts for their targeting efforts.","sources":[{"source":"ESET Contagious Interview BeaverTail InvisibleFerret February 2025","url":"https://www.welivesecurity.com/en/eset-research/deceptivedevelopment-targets-freelance-developers/"}]},{"technique_id":"T1683.002","description":"Contagious Interview has used AI to clone video-conferencing applications to distribute their BeaverTail malware. They have also used AI to create deepfake videos.","sources":[{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1684.001","description":"Contagious Interview had impersonated HR hiring personnel through social media, job board notifications, and conducted interviews with victims in order to entice them to download malware disguised as legitimate applications or malicious scripts from code repositories.","sources":[{"source":"Sentinel One Contagious Interview ClickFix September 2025","url":"https://www.sentinelone.com/labs/contagious-interview-threat-actors-scout-cyber-intel-platforms-reveal-plans-and-ops/"},{"source":"Validin Contagious Interview North Korea ClickFix January 2025","url":"https://www.validin.com/blog/inoculating_contagious_interview_with_validin/"},{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"},{"source":"SecurityScorecard Contagious Interview October 2024","url":"https://securityscorecard.com/blog/inside-a-north-korean-phishing-operation-targeting-devops-employees/"},{"source":"Securonix Contagious Interview DEVPOPPER April 2024","url":"https://www.securonix.com/blog/analysis-of-devpopper-new-attack-campaign-targeting-software-developers-likely-associated-with-north-korean-threat-actors/"},{"source":"SecurityScorecard Contagious Interview FamousChollima October 2024","url":"https://securityscorecard.com/blog/the-job-offer-that-wasnt-how-we-stopped-an-espionage-plot/"},{"source":"PaloAlto ContagiousInterview BeaverTail InvisibleFerret November 2023","url":"https://unit42.paloaltonetworks.com/two-campaigns-by-north-korea-bad-actors-target-job-hunters/"},{"source":"PaloAlto Unit42 ContagiousInterview BeaverTail InvisibileFerret October 2024","url":"https://unit42.paloaltonetworks.com/north-korean-threat-actors-lure-tech-job-seekers-as-fake-recruiters/"}]},{"technique_id":"T1685","description":"Contagious Interview has convinced victims to disable Docker and other container environments and run code on their machine natively in attempts to bypass container isolation and ensure device infection.","sources":[{"source":"Socket HexEval BeaverTail Contagious Interview June 2025","url":"https://socket.dev/blog/north-korean-contagious-interview-campaign-drops-35-new-malicious-npm-packages"}]}]},{"id":"G0052","name":"CopyKittens","procedures":[{"technique_id":"T1059.001","description":"CopyKittens has used PowerShell Empire.","sources":[]},{"technique_id":"T1090","description":"CopyKittens has used the AirVPN service for operational activity.","sources":[{"source":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"technique_id":"T1218.011","description":"CopyKittens uses rundll32 to load various tools on victims, including a lateral movement tool named Vminst, Cobalt Strike, and shellcode.","sources":[]},{"technique_id":"T1553.002","description":"CopyKittens digitally signed an executable with a stolen certificate from legitimate company AI Squared.","sources":[]},{"technique_id":"T1560.001","description":"CopyKittens uses ZPP, a .NET console program, to compress files with ZIP.","sources":[]},{"technique_id":"T1560.003","description":"CopyKittens encrypts data with a substitute cipher prior to exfiltration.","sources":[{"source":"CopyKittens Nov 2015","url":"https://cdn2.hubspot.net/hubfs/1903456/Whitepapers/CopyKittens.pdf"}]},{"technique_id":"T1564.003","description":"CopyKittens has used -w hidden and -windowstyle hidden to conceal PowerShell windows.","sources":[]},{"technique_id":"T1588.002","description":"CopyKittens has used Metasploit, Empire, and AirVPN for post-exploitation activities.","sources":[{"source":"ClearSky and Trend Micro Operation Wilted Tulip July 2017","url":"https://www.clearskysec.com/wp-content/uploads/2017/07/Operation_Wilted_Tulip.pdf"},{"source":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]}]},{"id":"G1012","name":"CURIUM","procedures":[{"technique_id":"T1005","description":"CURIUM has exfiltrated data from a compromised machine.","sources":[{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1041","description":"CURIUM has used IMAP and SMTPS for exfiltration via tools such as IMAPLoader.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"technique_id":"T1048.002","description":"CURIUM has used SMTPS to exfiltrate collected data from victims.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"technique_id":"T1059.001","description":"CURIUM has leveraged PowerShell scripts for initial process execution and data gathering in victim environments.","sources":[{"source":"Symantec Tortoiseshell 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"}]},{"technique_id":"T1082","description":"CURIUM deploys information gathering tools focused on capturing IP configuration, running application, system information, and network connectivity information.","sources":[{"source":"Symantec Tortoiseshell 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"}]},{"technique_id":"T1124","description":"CURIUM deployed mechanisms to check system time information following strategic website compromise attacks.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"technique_id":"T1189","description":"CURIUM has used strategic website compromise to infect victims with malware such as IMAPLoader.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"technique_id":"T1204.002","description":"CURIUM has lured users into opening malicious files delivered via social media.","sources":[{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1505.003","description":"CURIUM has been linked to web shells following likely server compromise as an initial access vector into victim networks.","sources":[{"source":"Symantec Tortoiseshell 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/tortoiseshell-apt-supply-chain"}]},{"technique_id":"T1566.001","description":"CURIUM has used phishing with malicious attachments for initial access to victim environments.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"technique_id":"T1566.003","description":"CURIUM has used social media to deliver malicious files to victims.","sources":[{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1583.001","description":"CURIUM created domains to facilitate strategic website compromise and credential capture activities.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"technique_id":"T1583.003","description":"CURIUM created virtual private server instances to facilitate use of malicious domains and other items.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"technique_id":"T1583.004","description":"CURIUM has created dedicated servers for command and control and exfiltration purposes.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"technique_id":"T1584.006","description":"CURIUM has compromised legitimate websites to enable strategic website compromise attacks.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"technique_id":"T1585.001","description":"CURIUM has established a network of fictitious social media accounts, including on Facebook and LinkedIn, to establish relationships with victims, often posing as an attractive woman.","sources":[{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1585.002","description":"CURIUM has created dedicated email accounts for use with tools such as IMAPLoader.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"technique_id":"T1598.003","description":"CURIUM used malicious links to adversary-controlled resources for credential harvesting.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]},{"technique_id":"T1608.004","description":"CURIUM used strategic website compromise to fingerprint then target victims.","sources":[{"source":"PWC Yellow Liderc 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/yellow-liderc-ships-its-scripts-delivers-imaploader-malware.html"}]}]},{"id":"G1034","name":"Daggerfly","procedures":[{"technique_id":"T1003.002","description":"Daggerfly used Reg to dump the Security Account Manager (SAM) hive from victim machines for follow-on credential extraction.","sources":[{"source":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"technique_id":"T1012","description":"Daggerfly used Reg to dump the Security Account Manager (SAM), System, and Security Windows registry hives from victim machines.","sources":[{"source":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"technique_id":"T1036.003","description":"Daggerfly used a renamed version of rundll32.exe, such as \"dbengin.exe\" located in the ProgramData\\Microsoft\\PlayReady directory, to proxy malicious DLL execution.","sources":[{"source":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"technique_id":"T1053.005","description":"Daggerfly has attempted to use scheduled tasks for persistence in victim environments.","sources":[{"source":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"technique_id":"T1059.001","description":"Daggerfly used PowerShell to download and execute remote-hosted files on victim systems.","sources":[{"source":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"technique_id":"T1071.001","description":"Daggerfly uses HTTP for command and control communication.","sources":[{"source":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"technique_id":"T1082","description":"Daggerfly utilizes victim machine operating system information to create custom User Agent strings for subsequent command and control communication.","sources":[{"source":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"technique_id":"T1105","description":"Daggerfly has used PowerShell and BITSAdmin to retrieve follow-on payloads from external locations for execution on victim machines.","sources":[{"source":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"technique_id":"T1136.001","description":"Daggerfly created a local account on victim machines to maintain access.","sources":[{"source":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"technique_id":"T1189","description":"Daggerfly has used strategic website compromise for initial access against victims.","sources":[{"source":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"technique_id":"T1195.002","description":"Daggerfly is associated with several supply chain compromises using malicious updates to compromise victims.","sources":[{"source":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"},{"source":"ESET EvasivePanda 2023","url":"https://www.welivesecurity.com/2023/04/26/evasive-panda-apt-group-malware-updates-popular-chinese-software/"}]},{"technique_id":"T1204.001","description":"Daggerfly has used strategic website compromise to deliver a malicious link requiring user interaction.","sources":[{"source":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"technique_id":"T1218.011","description":"Daggerfly proxied execution of malicious DLLs through a renamed rundll32.exe binary.","sources":[{"source":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"technique_id":"T1553.002","description":"Daggerfly has used signed, but not notarized, malicious files for execution in macOS environments.","sources":[{"source":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"technique_id":"T1574.001","description":"Daggerfly has used legitimate software to side-load PlugX loaders onto victim systems. Daggerfly is also linked to multiple other instances of side-loading for initial loading activity.","sources":[{"source":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"},{"source":"Symantec Daggerfly 2023","url":"https://symantec-enterprise-blogs.security.com/threat-intelligence/apt-attacks-telecoms-africa-mgbot"}]},{"technique_id":"T1584.004","description":"Daggerfly compromised web servers hosting updates for software as part of a supply chain intrusion.","sources":[{"source":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]},{"technique_id":"T1587.002","description":"Daggerfly created code signing certificates to sign malicious macOS files.","sources":[{"source":"ESET EvasivePanda 2024","url":"https://www.welivesecurity.com/en/eset-research/evasive-panda-leverages-monlam-festival-target-tibetans/"}]}]},{"id":"G0070","name":"Dark Caracal","procedures":[{"technique_id":"T1005","description":"Dark Caracal collected complete contents of the 'Pictures' folder from compromised Windows systems.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"technique_id":"T1027.002","description":"Dark Caracal has used UPX to pack Bandook.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"technique_id":"T1027.013","description":"Dark Caracal has obfuscated strings in Bandook by base64 encoding, and then encrypting them.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"technique_id":"T1059.003","description":"Dark Caracal has used macros in Word documents that would download a second stage if executed.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"technique_id":"T1071.001","description":"Dark Caracal's version of Bandook communicates with their server over a TCP port using HTTP payloads Base64 encoded and suffixed with the string “&&&”.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"technique_id":"T1083","description":"Dark Caracal collected file listings of all default Windows directories.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"technique_id":"T1113","description":"Dark Caracal took screenshots using their Windows malware.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"technique_id":"T1189","description":"Dark Caracal leveraged a watering hole to serve up malicious code.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"technique_id":"T1204.002","description":"Dark Caracal makes their malware look like Flash Player, Office, or PDF documents in order to entice a user to click on it.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"technique_id":"T1218.001","description":"Dark Caracal leveraged a compiled HTML file that contained a command to download and run an executable.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"technique_id":"T1547.001","description":"Dark Caracal's version of Bandook adds a registry key to HKEY_USERS\\Software\\Microsoft\\Windows\\CurrentVersion\\Run for persistence.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]},{"technique_id":"T1566.003","description":"Dark Caracal spearphished victims via Facebook and Whatsapp.","sources":[{"source":"Lookout Dark Caracal Jan 2018","url":"https://info.lookout.com/rs/051-ESQ-475/images/Lookout_Dark-Caracal_srr_20180118_us_v.1.0.pdf"}]}]},{"id":"G0012","name":"Darkhotel","procedures":[{"technique_id":"T1016","description":"Darkhotel has collected the IP address and network adapter information from the victim’s machine.","sources":[{"source":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"},{"source":"Microsoft DUBNIUM July 2016","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}]},{"technique_id":"T1027.013","description":"Darkhotel has obfuscated code using RC4, XOR, and RSA.","sources":[{"source":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"},{"source":"Microsoft DUBNIUM July 2016","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}]},{"technique_id":"T1036.005","description":"Darkhotel has used malware that is disguised as a Secure Shell (SSH) tool.","sources":[{"source":"Microsoft DUBNIUM June 2016","url":"https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/"}]},{"technique_id":"T1056.001","description":"Darkhotel has used a keylogger.","sources":[{"source":"Kaspersky Darkhotel","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf"}]},{"technique_id":"T1057","description":"Darkhotel malware can collect a list of running processes on a system.","sources":[{"source":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"}]},{"technique_id":"T1059.003","description":"Darkhotel has dropped an mspaint.lnk shortcut to disk which launches a shell script that downloads and executes a file.","sources":[{"source":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"}]},{"technique_id":"T1080","description":"Darkhotel used a virus that propagates by infecting executables stored on shared drives.","sources":[{"source":"Kaspersky Darkhotel","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf"}]},{"technique_id":"T1082","description":"Darkhotel has collected the hostname, OS version, service pack version, and the processor architecture from the victim’s machine.","sources":[{"source":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"},{"source":"Microsoft DUBNIUM July 2016","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}]},{"technique_id":"T1083","description":"Darkhotel has used malware that searched for files with specific patterns.","sources":[{"source":"Microsoft DUBNIUM July 2016","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}]},{"technique_id":"T1091","description":"Darkhotel's selective infector modifies executables stored on removable media as a method of spreading across computers.","sources":[{"source":"Kaspersky Darkhotel","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf"}]},{"technique_id":"T1105","description":"Darkhotel has used first-stage payloads that download additional malware from C2 servers.","sources":[{"source":"Microsoft DUBNIUM June 2016","url":"https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/"}]},{"technique_id":"T1124","description":"Darkhotel malware can obtain system time from a compromised host.","sources":[{"source":"Lastline DarkHotel Just In Time Decryption Nov 2015","url":"https://www.lastline.com/labsblog/defeating-darkhotel-just-in-time-decryption/"}]},{"technique_id":"T1140","description":"Darkhotel has decrypted strings and imports using RC4 during execution.","sources":[{"source":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"},{"source":"Microsoft DUBNIUM July 2016","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}]},{"technique_id":"T1189","description":"Darkhotel used embedded iframes on hotel login portals to redirect selected victims to download malware.","sources":[{"source":"Kaspersky Darkhotel","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf"}]},{"technique_id":"T1203","description":"Darkhotel has exploited Adobe Flash vulnerability CVE-2015-8651 for execution.","sources":[{"source":"Microsoft DUBNIUM June 2016","url":"https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/"}]},{"technique_id":"T1204.002","description":"Darkhotel has sent spearphishing emails in an attempt to lure users into clicking on a malicious attachments.","sources":[{"source":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"},{"source":"Microsoft DUBNIUM July 2016","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}]},{"technique_id":"T1497","description":"Darkhotel malware has employed just-in-time decryption of strings to evade sandbox detection.","sources":[{"source":"Lastline DarkHotel Just In Time Decryption Nov 2015","url":"https://www.lastline.com/labsblog/defeating-darkhotel-just-in-time-decryption/"}]},{"technique_id":"T1497.001","description":"Darkhotel malware has used a series of checks to determine if it's being analyzed; checks include the length of executable names, if a filename ends with .Md5.exe, and if the program is executed from the root of the C:\\ drive, as well as checks for sandbox-related libraries.","sources":[{"source":"Lastline DarkHotel Just In Time Decryption Nov 2015","url":"https://www.lastline.com/labsblog/defeating-darkhotel-just-in-time-decryption/"},{"source":"Microsoft DUBNIUM June 2016","url":"https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/"}]},{"technique_id":"T1497.002","description":"Darkhotel has used malware that repeatedly checks the mouse cursor position to determine if a real user is on the system.","sources":[{"source":"Lastline DarkHotel Just In Time Decryption Nov 2015","url":"https://www.lastline.com/labsblog/defeating-darkhotel-just-in-time-decryption/"}]},{"technique_id":"T1518.001","description":"Darkhotel has searched for anti-malware strings and anti-virus processes running on the system.","sources":[{"source":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"},{"source":"Microsoft DUBNIUM June 2016","url":"https://www.microsoft.com/security/blog/2016/06/09/reverse-engineering-dubnium-2/"}]},{"technique_id":"T1547.001","description":"Darkhotel has been known to establish persistence by adding programs to the Run Registry key.","sources":[{"source":"Kaspersky Darkhotel","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf"}]},{"technique_id":"T1553.002","description":"Darkhotel has used code-signing certificates on its malware that are either forged due to weak keys or stolen. Darkhotel has also stolen certificates and signed backdoors and downloaders with them.","sources":[{"source":"Kaspersky Darkhotel","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08070903/darkhotel_kl_07.11.pdf"},{"source":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"}]},{"technique_id":"T1566.001","description":"Darkhotel has sent spearphishing emails with malicious RAR and .LNK attachments.","sources":[{"source":"Securelist Darkhotel Aug 2015","url":"https://securelist.com/darkhotels-attacks-in-2015/71713/"},{"source":"Microsoft DUBNIUM July 2016","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}]},{"technique_id":"T1573.001","description":"Darkhotel has used AES-256 and 3DES for C2 communications.","sources":[{"source":"Microsoft DUBNIUM July 2016","url":"https://www.microsoft.com/security/blog/2016/07/14/reverse-engineering-dubnium-stage-2-payload-analysis/"}]}]},{"id":"G0079","name":"DarkHydrus","procedures":[{"technique_id":"T1059.001","description":"DarkHydrus leveraged PowerShell to download and execute additional scripts for execution.","sources":[{"source":"Unit 42 DarkHydrus July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"},{"source":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"technique_id":"T1187","description":"DarkHydrus used Template Injection to launch an authentication window for users to enter their credentials.","sources":[{"source":"Unit 42 Phishery Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/"}]},{"technique_id":"T1204.002","description":"DarkHydrus has sent malware that required users to hit the enable button in Microsoft Excel to allow an .iqy file to be downloaded.","sources":[{"source":"Unit 42 DarkHydrus July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"},{"source":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"technique_id":"T1221","description":"DarkHydrus used an open-source tool, Phishery, to inject malicious remote template URLs into Microsoft Word documents and then sent them to victims to enable Forced Authentication.","sources":[{"source":"Unit 42 Phishery Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/"}]},{"technique_id":"T1564.003","description":"DarkHydrus has used -WindowStyle Hidden to conceal PowerShell windows.","sources":[{"source":"Unit 42 DarkHydrus July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"}]},{"technique_id":"T1566.001","description":"DarkHydrus has sent spearphishing emails with password-protected RAR archives containing malicious Excel Web Query files (.iqy). The group has also sent spearphishing emails that contained malicious Microsoft Office documents that use the “attachedTemplate” technique to load a template from a remote server.","sources":[{"source":"Unit 42 Phishery Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-darkhydrus-uses-phishery-harvest-credentials-middle-east/"},{"source":"Unit 42 DarkHydrus July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"},{"source":"Unit 42 Playbook Dec 2017","url":"https://web.archive.org/web/20230702043312/https://pan-unit42.github.io/playbook_viewer/"}]},{"technique_id":"T1588.002","description":"DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.","sources":[{"source":"Unit 42 DarkHydrus July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-new-threat-actor-group-darkhydrus-targets-middle-east-government/"}]}]},{"id":"G0105","name":"DarkVishnya","procedures":[{"technique_id":"T1040","description":"DarkVishnya used network sniffing to obtain login data.","sources":[{"source":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}]},{"technique_id":"T1046","description":"DarkVishnya performed port scanning to obtain the list of active services.","sources":[{"source":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}]},{"technique_id":"T1059.001","description":"DarkVishnya used PowerShell to create shellcode loaders.","sources":[{"source":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}]},{"technique_id":"T1110","description":"DarkVishnya used brute-force attack to obtain login data.","sources":[{"source":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}]},{"technique_id":"T1135","description":"DarkVishnya scanned the network for public shared folders.","sources":[{"source":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}]},{"technique_id":"T1200","description":"DarkVishnya physically connected Bash Bunny, Raspberry Pi, netbooks, and inexpensive laptops to the target organization's environment to access the company’s local network.","sources":[{"source":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}]},{"technique_id":"T1219","description":"DarkVishnya used DameWare Mini Remote Control for lateral movement.","sources":[{"source":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}]},{"technique_id":"T1543.003","description":"DarkVishnya created new services for shellcode loaders distribution.","sources":[{"source":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}]},{"technique_id":"T1571","description":"DarkVishnya used ports 5190 and 7900 for shellcode listeners, and 4444, 4445, 31337 for shellcode C2.","sources":[{"source":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}]},{"technique_id":"T1588.002","description":"DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.","sources":[{"source":"Securelist DarkVishnya Dec 2018","url":"https://securelist.com/darkvishnya/89169/"}]}]},{"id":"G0009","name":"Deep Panda","procedures":[{"technique_id":"T1018","description":"Deep Panda has used ping to identify other machines of interest.","sources":[{"source":"Alperovitch 2014","url":"https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"}]},{"technique_id":"T1021.002","description":"Deep Panda uses net.exe to connect to network shares using net use commands with compromised credentials.","sources":[{"source":"Alperovitch 2014","url":"https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"}]},{"technique_id":"T1027.005","description":"Deep Panda has updated and modified its malware, resulting in different hash values that evade detection.","sources":[{"source":"Symantec Black Vine","url":"https://web.archive.org/web/20170823094836/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf"}]},{"technique_id":"T1047","description":"The Deep Panda group is known to utilize WMI for lateral movement.","sources":[{"source":"Alperovitch 2014","url":"https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"}]},{"technique_id":"T1057","description":"Deep Panda uses the Microsoft Tasklist utility to list processes running on systems.","sources":[{"source":"Alperovitch 2014","url":"https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"}]},{"technique_id":"T1059.001","description":"Deep Panda has used PowerShell scripts to download and execute programs in memory, without writing to disk.","sources":[{"source":"Alperovitch 2014","url":"https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"}]},{"technique_id":"T1218.010","description":"Deep Panda has used regsvr32.exe to execute a server variant of Derusbi in victim networks.","sources":[{"source":"RSA Shell Crew","url":"https://www.rsa.com/content/dam/en/white-paper/rsa-incident-response-emerging-threat-profile-shell-crew.pdf"}]},{"technique_id":"T1505.003","description":"Deep Panda uses Web shells on publicly accessible Web servers to access victim networks.","sources":[]},{"technique_id":"T1546.008","description":"Deep Panda has used the sticky-keys technique to bypass the RDP login screen on remote systems during intrusions.","sources":[{"source":"RSA Shell Crew","url":"https://www.rsa.com/content/dam/en/white-paper/rsa-incident-response-emerging-threat-profile-shell-crew.pdf"}]},{"technique_id":"T1564.003","description":"Deep Panda has used -w hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.","sources":[{"source":"Alperovitch 2014","url":"https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"}]}]},{"id":"G0035","name":"Dragonfly","procedures":[{"technique_id":"T1003.002","description":"Dragonfly has dropped and executed SecretsDump to dump password hashes.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1003.003","description":"Dragonfly has dropped and executed SecretsDump to dump password hashes. They also obtained ntds.dit from domain controllers.","sources":[{"source":"Core Security Impacket","url":"https://www.coresecurity.com/core-labs/open-source-tools/impacket"},{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1003.004","description":"Dragonfly has dropped and executed SecretsDump to dump password hashes.","sources":[{"source":"Core Security Impacket","url":"https://www.coresecurity.com/core-labs/open-source-tools/impacket"},{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1005","description":"Dragonfly has collected data from local victim systems.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1012","description":"Dragonfly has queried the Registry to identify victim information.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1016","description":"Dragonfly has used batch scripts to enumerate network information, including information about trusts, zones, and the domain.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1018","description":"Dragonfly has likely obtained a list of hosts in the victim environment.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1021.001","description":"Dragonfly has moved laterally via RDP.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1033","description":"Dragonfly used the command query user on victim hosts.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1036.010","description":"Dragonfly has created accounts disguised as legitimate backup and service accounts as well as an email administration account.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1053.005","description":"Dragonfly has used scheduled tasks to automatically log out of created accounts every 8 hours as well as to execute malicious files.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1059","description":"Dragonfly has used the command line for execution.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1059.001","description":"Dragonfly has used PowerShell scripts for execution.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"},{"source":"Symantec Dragonfly Sept 2017","url":"https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers"}]},{"technique_id":"T1059.003","description":"Dragonfly has used various types of scripting to perform operations, including batch scripts.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1059.006","description":"Dragonfly has used various types of scripting to perform operations, including Python scripts. The group was observed installing Python 2.7 on a victim.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1069.002","description":"Dragonfly has used batch scripts to enumerate administrators and users in the domain.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1070.004","description":"Dragonfly has deleted many of its files used during operations as part of cleanup, including removing applications and deleting screenshots.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1071.002","description":"Dragonfly has used SMB for C2.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1074.001","description":"Dragonfly has created a directory named \"out\" in the user's %AppData% folder and copied files to it.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1078","description":"Dragonfly has compromised user credentials and used valid accounts for operations.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"},{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"},{"source":"CISA AA20-296A Berserk Bear December 2020","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"}]},{"technique_id":"T1083","description":"Dragonfly has used a batch script to gather folder and file names from victim hosts.","sources":[{"source":"CISA AA20-296A Berserk Bear December 2020","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"},{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"},{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1087.002","description":"Dragonfly has used batch scripts to enumerate users on a victim domain controller.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1098.007","description":"Dragonfly has added newly created accounts to the administrators group to maintain elevated access.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1105","description":"Dragonfly has copied and installed tools for operations once in the victim environment.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1110","description":"Dragonfly has attempted to brute force credentials to gain access.","sources":[{"source":"CISA AA20-296A Berserk Bear December 2020","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"}]},{"technique_id":"T1110.002","description":"Dragonfly has dropped and executed tools used for password cracking, including Hydra and CrackMapExec.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"},{"source":"Kali Hydra","url":"https://tools.kali.org/password-attacks/hydra"}]},{"technique_id":"T1112","description":"Dragonfly has modified the Registry to perform multiple techniques through the use of Reg.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1113","description":"Dragonfly has performed screen captures of victims, including by using a tool, scr.exe (which matched the hash of ScreenUtil).","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"},{"source":"Symantec Dragonfly Sept 2017","url":"https://docs.broadcom.com/doc/dragonfly_threat_against_western_energy_suppliers"},{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"technique_id":"T1114.002","description":"Dragonfly has accessed email accounts using Outlook Web Access.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1133","description":"Dragonfly has used VPNs and Outlook Web Access (OWA) to maintain access to victim networks.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"},{"source":"CISA AA20-296A Berserk Bear December 2020","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"}]},{"technique_id":"T1135","description":"Dragonfly has identified and browsed file servers in the victim network, sometimes , viewing files pertaining to ICS or Supervisory Control and Data Acquisition (SCADA) systems.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1136.001","description":"Dragonfly has created accounts on victims, including administrator accounts, some of which appeared to be tailored to each individual staging target.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1187","description":"Dragonfly has gathered hashed user credentials over SMB using spearphishing attachments with external resource links and by modifying .LNK file icon resources to collect credentials from virtualized systems.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"},{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"technique_id":"T1189","description":"Dragonfly has compromised targets via strategic web compromise (SWC) utilizing a custom exploit kit.","sources":[{"source":"Secureworks IRON LIBERTY July 2019","url":"https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector"},{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"},{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"technique_id":"T1190","description":"Dragonfly has conducted SQL injection attacks, exploited vulnerabilities CVE-2019-19781 and CVE-2020-0688 for Citrix and MS Exchange, and CVE-2018-13379 for Fortinet VPNs.","sources":[{"source":"CISA AA20-296A Berserk Bear December 2020","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"}]},{"technique_id":"T1195.002","description":"Dragonfly has placed trojanized installers for control system software on legitimate vendor app stores.","sources":[{"source":"Secureworks IRON LIBERTY July 2019","url":"https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector"},{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"technique_id":"T1203","description":"Dragonfly has exploited CVE-2011-0611 in Adobe Flash Player to gain execution on a targeted system.","sources":[{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"technique_id":"T1204.002","description":"Dragonfly has used various forms of spearphishing in attempts to get users to open malicious attachments.","sources":[{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"technique_id":"T1210","description":"Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.","sources":[{"source":"CISA AA20-296A Berserk Bear December 2020","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"}]},{"technique_id":"T1221","description":"Dragonfly has injected SMB URLs into malicious Word spearphishing attachments to initiate Forced Authentication.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1505.003","description":"Dragonfly has commonly created Web shells on victims' publicly accessible email and web servers, which they used to maintain access to a victim network and download additional malicious files.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1547.001","description":"Dragonfly has added the registry value ntdll to the Registry Run key to establish persistence.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1560","description":"Dragonfly has compressed data into .zip files prior to exfiltration.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1564.002","description":"Dragonfly has modified the Registry to hide created user accounts.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1566.001","description":"Dragonfly has sent emails with malicious attachments to gain initial access.","sources":[{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"technique_id":"T1583.001","description":"Dragonfly has registered domains for targeting intended victims.","sources":[{"source":"CISA AA20-296A Berserk Bear December 2020","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"}]},{"technique_id":"T1583.003","description":"Dragonfly has acquired VPS infrastructure for use in malicious campaigns.","sources":[{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"technique_id":"T1584.004","description":"Dragonfly has compromised legitimate websites to host C2 and malware modules.","sources":[{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"technique_id":"T1588.002","description":"Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.","sources":[{"source":"Secureworks IRON LIBERTY July 2019","url":"https://www.secureworks.com/research/resurgent-iron-liberty-targeting-energy-sector"}]},{"technique_id":"T1591.002","description":"Dragonfly has collected open source information to identify relationships between organizations for targeting purposes.","sources":[{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"technique_id":"T1595.002","description":"Dragonfly has scanned targeted systems for vulnerable Citrix and Microsoft Exchange services.","sources":[{"source":"CISA AA20-296A Berserk Bear December 2020","url":"https://www.cisa.gov/uscert/ncas/alerts/aa20-296a#revisions"}]},{"technique_id":"T1598.002","description":"Dragonfly has used spearphishing with Microsoft Office attachments to enable harvesting of user credentials.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1598.003","description":"Dragonfly has used spearphishing with PDF attachments containing malicious links that redirected to credential harvesting websites.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1608.004","description":"Dragonfly has compromised websites to redirect traffic and to host exploit kits.","sources":[{"source":"Gigamon Berserk Bear October 2021","url":"https://vblocalhost.com/uploads/VB2021-Slowik.pdf"}]},{"technique_id":"T1685.005","description":"Dragonfly has cleared Windows event logs and other logs produced by tools they used, including system, security, terminal services, remote services, and audit logs. The actors also deleted specific Registry keys.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]},{"technique_id":"T1686","description":"Dragonfly has disabled host-based firewalls. The group has also globally opened port 3389.","sources":[{"source":"US-CERT TA18-074A","url":"https://www.us-cert.gov/ncas/alerts/TA18-074A"}]}]},{"id":"G0017","name":"DragonOK","procedures":[]},{"id":"G1006","name":"Earth Lusca","procedures":[{"technique_id":"T1003.001","description":"Earth Lusca has used ProcDump to obtain the hashes of credentials by dumping the memory of the LSASS process.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1003.006","description":"Earth Lusca has used a DCSync command with Mimikatz to retrieve credentials from an exploited controller.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1007","description":"Earth Lusca has used Tasklist to obtain information from a compromised host.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1016","description":"Earth Lusca used the command ipconfig to obtain information about network configurations.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1018","description":"Earth Lusca used the command powershell “Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list - property * | findstr “Address”” to find the network information of successfully logged-in accounts to discovery addresses of other machines. Earth Lusca has also used multiple scanning tools to discover other machines within the same compromised network.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1027","description":"Earth Lusca used Base64 to encode strings.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1027.003","description":"Earth Lusca has used steganography to hide shellcode in a BMP image file.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1033","description":"Earth Lusca collected information on user accounts via the whoami command.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1036.005","description":"Earth Lusca used the command move [file path] c:\\windows\\system32\\spool\\prtprocs\\x64\\spool.dll to move and register a malicious DLL name as a Windows print processor, which eventually was loaded by the Print Spooler service.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1047","description":"Earth Lusca used a VBA script to execute WMI.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1049","description":"Earth Lusca employed a PowerShell script called RDPConnectionParser to read and filter the Windows event log “Microsoft-Windows-TerminalServices-RDPClient/Operational” (Event ID 1024) to obtain network information from RDP connections. Earth Lusca has also used netstat from a compromised system to obtain network connection information.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1053.005","description":"Earth Lusca used the command schtasks /Create /SC ONLOgon /TN WindowsUpdateCheck /TR “[file path]” /ru system for persistence.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1057","description":"Earth Lusca has used Tasklist to obtain information from a compromised host.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1059.001","description":"Earth Lusca has used PowerShell to execute commands.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1059.005","description":"Earth Lusca used VBA scripts.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1059.006","description":"Earth Lusca used Python scripts for port scanning or building reverse shells.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1059.007","description":"Earth Lusca has manipulated legitimate websites to inject malicious JavaScript code as part of their watering hole operations.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1090","description":"Earth Lusca adopted Cloudflare as a proxy for compromised servers.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1098.004","description":"Earth Lusca has dropped an SSH-authorized key in the /root/.ssh folder in order to access a compromised server with SSH.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1112","description":"Earth Lusca modified the registry using the command reg add “HKEY_CURRENT_USER\\Environment” /v UserInitMprLogonScript /t REG_SZ /d “[file path]” for persistence.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1140","description":"Earth Lusca has used certutil to decode a string into a cabinet file.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1189","description":"Earth Lusca has performed watering hole attacks.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1190","description":"Earth Lusca has compromised victims by directly exploiting vulnerabilities of public-facing servers, including those associated with Microsoft Exchange and Oracle GlassFish.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1204.001","description":"Earth Lusca has sent spearphishing emails that required the user to click on a malicious link and subsequently open a decoy document with a malicious loader.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1204.002","description":"Earth Lusca required users to click on a malicious file for the loader to activate.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1210","description":"Earth Lusca has used Mimikatz to exploit a domain controller via the ZeroLogon exploit (CVE-2020-1472).","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1218.005","description":"Earth Lusca has used mshta.exe to load an HTA script within a malicious .LNK file.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1482","description":"Earth Lusca has used Nltest to obtain information about domain controllers.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1543.003","description":"Earth Lusca created a service using the command sc create “SysUpdate” binpath= “cmd /c start “[file path]””&&sc config “SysUpdate” start= auto&&net start SysUpdate for persistence.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1547.012","description":"Earth Lusca has added the Registry key HKLM\\SYSTEM\\ControlSet001\\Control\\Print\\Environments\\Windows x64\\Print Processors\\UDPrint” /v Driver /d “spool.dll /f to load malware as a Print Processor.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1548.002","description":"Earth Lusca has used the Fodhelper UAC bypass technique to gain elevated privileges.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1560.001","description":"Earth Lusca has used WinRAR to compress stolen files into an archive prior to exfiltration.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1566.002","description":"Earth Lusca has sent spearphishing emails to potential targets that contained a malicious link.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1567.002","description":"Earth Lusca has used the megacmd tool to upload stolen files from a victim network to MEGA.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1574.001","description":"Earth Lusca has placed a malicious payload in %WINDIR%\\SYSTEM32\\oci.dll so it would be sideloaded by the MSDTC service.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1583.001","description":"Earth Lusca has registered domains, intended to look like legitimate target domains, that have been used in watering hole attacks.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1583.004","description":"Earth Lusca has acquired multiple servers for some of their operations, using each server for a different role.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1583.006","description":"Earth Lusca has established GitHub accounts to host their malware.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1584.004","description":"Earth Lusca has used compromised web servers as part of their operational infrastructure.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1584.006","description":"Earth Lusca has compromised Google Drive repositories.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1588.001","description":"Earth Lusca has acquired and used a variety of malware, including Cobalt Strike.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1588.002","description":"Earth Lusca has acquired and used a variety of open source tools.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1595.002","description":"Earth Lusca has scanned for vulnerabilities in the public-facing servers of their targets.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]},{"technique_id":"T1608.001","description":"Earth Lusca has staged malware and malicious files on compromised web servers, GitHub, and Google Drive.","sources":[{"source":"TrendMicro EarthLusca 2022","url":"https://www.trendmicro.com/content/dam/trendmicro/global/en/research/22/a/earth-lusca-employs-sophisticated-infrastructure-varied-tools-and-techniques/technical-brief-delving-deep-an-analysis-of-earth-lusca-operations.pdf"}]}]},{"id":"G0066","name":"Elderwood","procedures":[{"technique_id":"T1027.002","description":"Elderwood has packed malware payloads before delivery to victims.","sources":[{"source":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}]},{"technique_id":"T1027.013","description":"Elderwood has encrypted documents and malicious executables.","sources":[{"source":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}]},{"technique_id":"T1105","description":"The Ritsol backdoor trojan used by Elderwood can download files onto a compromised host from a remote location.","sources":[{"source":"Symantec Ristol May 2012","url":"https://www.symantec.com/security_response/writeup.jsp?docid=2012-051515-3909-99"}]},{"technique_id":"T1189","description":"Elderwood has delivered zero-day exploits and malware to victims by injecting malicious code into specific public Web pages visited by targets within a particular sector.","sources":[{"source":"CSM Elderwood Sept 2012","url":"https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China"},{"source":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}]},{"technique_id":"T1203","description":"Elderwood has used exploitation of endpoint software, including Microsoft Internet Explorer Adobe Flash vulnerabilities, to gain execution. They have also used zero-day exploits.","sources":[{"source":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}]},{"technique_id":"T1204.001","description":"Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open links.","sources":[{"source":"CSM Elderwood Sept 2012","url":"https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China"},{"source":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}]},{"technique_id":"T1204.002","description":"Elderwood has leveraged multiple types of spearphishing in order to attempt to get a user to open attachments.","sources":[{"source":"CSM Elderwood Sept 2012","url":"https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China"},{"source":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}]},{"technique_id":"T1566.001","description":"Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing malicious attachments.","sources":[{"source":"CSM Elderwood Sept 2012","url":"https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China"},{"source":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}]},{"technique_id":"T1566.002","description":"Elderwood has delivered zero-day exploits and malware to victims via targeted emails containing a link to malicious content hosted on an uncommon Web server.","sources":[{"source":"CSM Elderwood Sept 2012","url":"https://www.csmonitor.com/USA/2012/0914/Stealing-US-business-secrets-Experts-ID-two-huge-cyber-gangs-in-China"},{"source":"Symantec Elderwood Sept 2012","url":"https://web.archive.org/web/20190717233006/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-elderwood-project.pdf"}]}]},{"id":"G1003","name":"Ember Bear","procedures":[{"technique_id":"T1003","description":"Ember Bear gathers credential material from target systems, such as SSH keys, to facilitate access to victim environments.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1003.001","description":"Ember Bear uses legitimate Sysinternals tools such as procdump to dump LSASS memory.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1003.002","description":"Ember Bear acquires victim credentials by extracting registry hives such as the Security Account Manager through commands such as reg save.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1003.004","description":"Ember Bear has used frameworks such as Impacket to dump LSA secrets for credential capture.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1005","description":"Ember Bear gathers victim system information such as enumerating the volume of a given device or extracting system and security event logs for analysis.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1018","description":"Ember Bear has used tools such as Nmap and MASSCAN for remote service discovery.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1021","description":"Ember Bear uses valid network credentials gathered through credential harvesting to move laterally within victim networks, often employing the Impacket framework to do so.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1036","description":"Ember Bear has renamed the legitimate Sysinternals tool procdump to alternative names such as dump64.exe to evade detection.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1036.005","description":"Ember Bear has renamed tools to match legitimate utilities, such as renaming GOST tunneling instances to java in victim environments.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1046","description":"Ember Bear has used tools such as NMAP for remote system discovery and enumeration in victim environments.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1047","description":"Ember Bear has used WMI execution with password hashes for command execution and lateral movement.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1053.005","description":"Ember Bear uses remotely scheduled tasks to facilitate remote command execution on victim machines.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1059.001","description":"Ember Bear has used PowerShell commands to gather information from compromised systems, such as email servers.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1070.004","description":"Ember Bear deletes files related to lateral movement to avoid detection.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1071.004","description":"Ember Bear has used DNS tunnelling tools, such as dnscat/2 and Iodine, for C2 purposes.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1078.001","description":"Ember Bear has abused default user names and passwords in externally-accessible IP cameras for initial access.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1090.003","description":"Ember Bear has configured multi-hop proxies via ProxyChains within victim environments.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1095","description":"Ember Bear uses socket-based tunneling utilities for command and control purposes such as NetCat and Go Simple Tunnel (GOST). These tunnels are used to push interactive command prompts over the created sockets. Ember Bear has also used reverse TCP connections from Meterpreter installations to communicate back with C2 infrastructure.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1110","description":"Ember Bear used the su-bruteforce tool to brute force specific users using the su command.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1110.003","description":"Ember Bear has conducted password spraying against Outlook Web Access (OWA) infrastructure to identify valid user names and passwords.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1112","description":"Ember Bear modifies registry values for anti-forensics and defense evasion purposes.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1114","description":"Ember Bear attempts to collect mail from accessed systems and servers.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1119","description":"Ember Bear engages in mass collection from compromised systems during intrusions.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1125","description":"Ember Bear has exfiltrated images from compromised IP cameras.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1133","description":"Ember Bear have used VPNs both for initial access to victim environments and for persistence within them following compromise.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1190","description":"Ember Bear gains initial access to victim environments by exploiting external-facing services. Examples include exploitation of CVE-2021-26084 in Confluence servers; CVE-2022-41040, ProxyShell, and other vulnerabilities in Microsoft Exchange; and multiple vulnerabilities in open-source platforms such as content management systems.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1195","description":"Ember Bear has compromised information technology providers and software developers providing services to targets of interest, building initial access to ultimate victims at least in part through compromise of service providers that work with the victim organizations.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1203","description":"Ember Bear has used exploits to enable follow-on execution of frameworks such as Meterpreter.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1210","description":"Ember Bear has used exploits for vulnerabilities such as MS17-010, also known as Eternal Blue, during operations.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1491.002","description":"Ember Bear is linked to the defacement of several Ukrainian organization websites.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1505.003","description":"Ember Bear deploys web shells following initial access for either follow-on command execution or protocol tunneling. Example web shells used by Ember Bear include P0wnyshell, reGeorg, P.A.S. Webshell, and custom variants of publicly-available web shell examples.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1550.002","description":"Ember Bear has used pass-the-hash techniques for lateral movement in victim environments.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1552.001","description":"Ember Bear has dumped configuration settings in accessed IP cameras including plaintext credentials.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1560","description":"Ember Bear has compressed collected data prior to exfiltration.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1561.002","description":"Ember Bear conducted destructive operations against victims, including disk structure wiping, via the WhisperGate malware in Ukraine.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1567.002","description":"Ember Bear has used tools such as Rclone to exfiltrate information from victim environments to cloud storage such as mega.nz.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1570","description":"Ember Bear retrieves follow-on payloads direct from adversary-owned infrastructure for deployment on compromised hosts.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1571","description":"Ember Bear has used various non-standard ports for C2 communication.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1572","description":"Ember Bear has used ProxyChains to tunnel protocols to internal networks.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1583","description":"Ember Bear uses services such as IVPN, SurfShark, and Tor to add anonymization to operations.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1583.003","description":"Ember Bear has used virtual private servers (VPSs) to host tools, perform reconnaissance, exploit victim infrastructure, and as a destination for data exfiltration.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1585","description":"Ember Bear has created accounts on dark web forums to obtain various tools and malware.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1588.001","description":"Ember Bear has acquired malware and related tools from dark web forums.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1588.005","description":"Ember Bear has obtained exploitation scripts against publicly-disclosed vulnerabilities from public repositories.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1595.001","description":"Ember Bear has targeted IP ranges for vulnerability scanning related to government and critical infrastructure organizations.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1595.002","description":"Ember Bear has used publicly available tools such as MASSCAN and Acunetix for vulnerability scanning of public-facing infrastructure.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]},{"technique_id":"T1654","description":"Ember Bear has enumerated SECURITY and SYSTEM log files during intrusions.","sources":[{"source":"CISA GRU29155 2024","url":"https://www.cisa.gov/sites/default/files/2024-09/aa24-249a-russian-military-cyber-actors-target-us-and-global-critical-infrastructure.pdf"}]}]},{"id":"G0020","name":"Equation","procedures":[{"technique_id":"T1120","description":"Equation has used tools with the functionality to search for specific information about the attached hard drive that could be used to identify and overwrite the firmware.","sources":[{"source":"Kaspersky Equation QA","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf"}]},{"technique_id":"T1480.001","description":"Equation has been observed utilizing environmental keying in payload delivery.","sources":[{"source":"Kaspersky Gauss Whitepaper","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/20134940/kaspersky-lab-gauss.pdf"},{"source":"Kaspersky Equation QA","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf"}]},{"technique_id":"T1542.002","description":"Equation is known to have the capability to overwrite the firmware on hard drives from some manufacturers.","sources":[{"source":"Kaspersky Equation QA","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf"}]},{"technique_id":"T1564.005","description":"Equation has used an encrypted virtual file system stored in the Windows Registry.","sources":[{"source":"Kaspersky Equation QA","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf"}]}]},{"id":"G0120","name":"Evilnum","procedures":[{"technique_id":"T1059.007","description":"Evilnum has used malicious JavaScript files on the victim's machine.","sources":[{"source":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]},{"technique_id":"T1070.004","description":"Evilnum has deleted files used during infection.","sources":[{"source":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]},{"technique_id":"T1105","description":"Evilnum can deploy additional components or tools as needed.","sources":[{"source":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]},{"technique_id":"T1204.001","description":"Evilnum has sent spearphishing emails designed to trick the recipient into opening malicious shortcut links which downloads a .LNK file.","sources":[{"source":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]},{"technique_id":"T1219.002","description":"EVILNUM has used the malware variant, TerraTV, to run a legitimate TeamViewer application to connect to compromised machines.","sources":[{"source":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]},{"technique_id":"T1497.001","description":"Evilnum has used a component called TerraLoader to check certain hardware and file information to detect sandboxed environments.","sources":[{"source":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]},{"technique_id":"T1539","description":"Evilnum can steal cookies and session information from browsers.","sources":[{"source":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]},{"technique_id":"T1548.002","description":"Evilnum has used PowerShell to bypass UAC.","sources":[{"source":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]},{"technique_id":"T1555","description":"Evilnum can collect email credentials from victims.","sources":[{"source":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]},{"technique_id":"T1566.002","description":"Evilnum has sent spearphishing emails containing a link to a zip file hosted on Google Drive.","sources":[{"source":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]},{"technique_id":"T1574.001","description":"Evilnum has used the malware variant, TerraTV, to load a malicious DLL placed in the TeamViewer directory, instead of the original Windows DLL located in a system folder.","sources":[{"source":"ESET EvilNum July 2020","url":"https://www.welivesecurity.com/2020/07/09/more-evil-deep-look-evilnum-toolset/"}]}]},{"id":"G1011","name":"EXOTIC LILY","procedures":[{"technique_id":"T1102","description":"EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1203","description":"EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1204.001","description":"EXOTIC LILY has used malicious links to lure users into executing malicious payloads.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1204.002","description":"EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.","sources":[{"source":"Proofpoint Bumblebee April 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"},{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1566.001","description":"EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.","sources":[{"source":"Proofpoint Bumblebee April 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/bumblebee-is-still-transforming"},{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1566.002","description":"EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1566.003","description":"EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1583.001","description":"EXOTIC LILY has registered domains to spoof targeted organizations by changing the top-level domain (TLD) to “.us”, “.co” or “.biz”.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1585.001","description":"EXOTIC LILY has established social media profiles to mimic employees of targeted companies.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1585.002","description":"EXOTIC LILY has created e-mail accounts to spoof targeted organizations.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1589.002","description":"EXOTIC LILY has gathered targeted individuals' e-mail addresses through open source research and website contact forms.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1593.001","description":"EXOTIC LILY has copied data from social media sites to impersonate targeted individuals.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1594","description":"EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1597","description":"EXOTIC LILY has searched for information on targeted individuals on business databases including RocketReach and CrunchBase.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]},{"technique_id":"T1608.001","description":"EXOTIC LILY has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.","sources":[{"source":"Google EXOTIC LILY March 2022","url":"https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"}]}]},{"id":"G0137","name":"Ferocious Kitten","procedures":[{"technique_id":"T1036.002","description":"Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.","sources":[{"source":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"technique_id":"T1036.005","description":"Ferocious Kitten has named malicious files update.exe and loaded them into the compromise host's “Public” folder.","sources":[{"source":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"technique_id":"T1204.002","description":"Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.","sources":[{"source":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"technique_id":"T1566.001","description":"Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.","sources":[{"source":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"technique_id":"T1583.001","description":"Ferocious Kitten has acquired domains imitating legitimate sites.","sources":[{"source":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]},{"technique_id":"T1588.002","description":"Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.","sources":[{"source":"Kaspersky Ferocious Kitten Jun 2021","url":"https://securelist.com/ferocious-kitten-6-years-of-covert-surveillance-in-iran/102806/"}]}]},{"id":"G0051","name":"FIN10","procedures":[{"technique_id":"T1021.001","description":"FIN10 has used RDP to move laterally to systems in the victim environment.","sources":[{"source":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"}]},{"technique_id":"T1033","description":"FIN10 has used Meterpreter to enumerate users on remote systems.","sources":[{"source":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"}]},{"technique_id":"T1053.005","description":"FIN10 has established persistence by using S4U tasks as well as the Scheduled Task option in PowerShell Empire.","sources":[{"source":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"},{"source":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}]},{"technique_id":"T1059.001","description":"FIN10 uses PowerShell for execution as well as PowerShell Empire to establish persistence.","sources":[{"source":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"},{"source":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}]},{"technique_id":"T1059.003","description":"FIN10 has executed malicious .bat files containing PowerShell commands.","sources":[{"source":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"}]},{"technique_id":"T1070.004","description":"FIN10 has used batch scripts and scheduled tasks to delete critical system files.","sources":[{"source":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"}]},{"technique_id":"T1078","description":"FIN10 has used stolen credentials to connect remotely to victim networks using VPNs protected with only a single factor.","sources":[{"source":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"}]},{"technique_id":"T1078.003","description":"FIN10 has moved laterally using the Local Administrator account.","sources":[{"source":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"}]},{"technique_id":"T1547.001","description":"FIN10 has established persistence by using the Registry option in PowerShell Empire to add a Run key.","sources":[{"source":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"},{"source":"Github PowerShell Empire","url":"https://github.com/PowerShellEmpire/Empire"}]},{"technique_id":"T1570","description":"FIN10 has deployed Meterpreter stagers and SplinterRAT instances in the victim network after moving laterally.","sources":[{"source":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"}]},{"technique_id":"T1588.002","description":"FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.","sources":[{"source":"FireEye FIN10 June 2017","url":"https://services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf"}]}]},{"id":"G1016","name":"FIN13","procedures":[{"technique_id":"T1003.001","description":"FIN13 has obtained memory dumps with ProcDump to parse and extract credentials from a victim's LSASS process memory with Mimikatz.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1003.002","description":"FIN13 has extracted the SAM and SYSTEM registry hives using the reg.exe binary for obtaining password hashes from a compromised machine.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1003.003","description":"FIN13 has harvested the NTDS.DIT file and leveraged the Impacket tool on the compromised domain controller to locally decrypt it.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1005","description":"FIN13 has gathered stolen credentials, sensitive data such as point-of-sale (POS), and ATM data from a compromised network before exfiltration.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1016","description":"FIN13 has used nslookup and ipconfig for network reconnaissance efforts. FIN13 has also utilized a compromised Symantec Altiris console and LanDesk account to retrieve network information.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1016.001","description":"FIN13 has used Ping and tracert for network reconnaissance efforts.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1021.001","description":"FIN13 has remotely accessed compromised environments via Remote Desktop Services (RDS) for lateral movement.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1021.002","description":"FIN13 has leveraged SMB to move laterally within a compromised network via application servers and SQL servers.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1021.004","description":"FIN13 has remotely accessed compromised environments via secure shell (SSH) for lateral movement.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1021.006","description":"FIN13 has leveraged WMI to move laterally within a compromised network via application servers and SQL servers.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1036","description":"FIN13 has masqueraded staged data by using the Windows certutil utility to generate fake Base64 encoded certificates with the input file.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1036.004","description":"FIN13 has used scheduled tasks names such as acrotyr and AppServicesr to mimic the same names in a compromised network's C:\\Windows directory.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1036.005","description":"FIN13 has masqueraded WAR files to look like legitimate packages such as, wsexample.war, wsexamples.com, examples.war, and exampl3s.war.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1046","description":"FIN13 has utilized nmap for reconnaissance efforts. FIN13 has also scanned for internal MS-SQL servers in a compromised network.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1047","description":"FIN13 has utilized WMI to execute commands and move laterally on compromised Windows machines.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1049","description":"FIN13 has used netstat and other net commands for network reconnaissance efforts.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1053.005","description":"FIN13 has created scheduled tasks in the C:\\Windows directory of the compromised network.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1056.001","description":"FIN13 has logged the keystrokes of victims to escalate privileges.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1059.001","description":"FIN13 has used PowerShell commands to obtain DNS data from a compromised network.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1059.003","description":"FIN13 has leveraged xp_cmdshell and Windows Command Shell to execute commands on a compromised machine. FIN13 has also attempted to leverage the ‘xp_cmdshell’ SQL procedure to execute remote commands on internal MS-SQL servers.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1059.005","description":"FIN13 has used VBS scripts for code execution on comrpomised machines.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1069","description":"FIN13 has enumerated all users and roles from a victim's main treasury system.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1071.001","description":"FIN13 has used HTTP requests to chain multiple web shells and to contact actor-controlled C2 servers prior to exfiltrating stolen data.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1074.001","description":"FIN13 has utilized the following temporary folders on compromised Windows and Linux systems for their operations prior to exfiltration: C:\\Windows\\Temp and /tmp.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1078.001","description":"FIN13 has leveraged default credentials for authenticating myWebMethods (WMS) and QLogic web management interface to gain initial access.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1082","description":"FIN13 has collected local host information by utilizing Windows commands systeminfo, fsutil, and fsinfo. FIN13 has also utilized a compromised Symantex Altiris console and LanDesk account to retrieve host information.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1083","description":"FIN13 has used the Windows dir command to enumerate files and directories in a victim's network.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1087","description":"FIN13 has enumerated all users and their roles from a victim's main treasury system.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1087.002","description":"FIN13 can identify user accounts associated with a Service Principal Name and query Service Principal Names within the domain by utilizing the following scripts: GetUserSPNs.vbs and querySpn.vbs.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1090.001","description":"FIN13 has utilized a proxy tool to communicate between compromised assets.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1098.007","description":"FIN13 has assigned newly created accounts the sysadmin role to maintain persistence.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1105","description":"FIN13 has downloaded additional tools and malware to compromised systems.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1133","description":"FIN13 has gained access to compromised environments via remote access services such as the corporate virtual private network (VPN).","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1134.003","description":"FIN13 has utilized tools such as Incognito V2 for token manipulation and impersonation.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1135","description":"FIN13 has executed net view commands for enumeration of open shares on compromised machines.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1136.001","description":"FIN13 has created MS-SQL local accounts in a compromised network.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1140","description":"FIN13 has utilized certutil to decode base64 encoded versions of custom malware.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1190","description":"FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1505.003","description":"FIN13 has utilized obfuscated and open-source web shells such as JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2 to enable remote code execution and to execute commands on compromised web server.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1547.001","description":"FIN13 has used Windows Registry run keys such as, HKEY_LOCAL_MACHINE\\SOFTWARE\\WOW6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\hosts to maintain persistence.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1550.002","description":"FIN13 has used the PowerShell utility Invoke-SMBExec to execute the pass the hash method for lateral movement within an compromised environment.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1552.001","description":"FIN13 has obtained administrative credentials by browsing through local files on a compromised machine.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1556","description":"FIN13 has replaced legitimate KeePass binaries with trojanized versions to collect passwords from numerous applications.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1560.001","description":"FIN13 has compressed the dump output of compromised credentials with a 7zip binary.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1564.001","description":"FIN13 has created hidden files and folders within a compromised Linux system /tmp directory. FIN13 also has used attrib.exe to hide gathered local host information.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1565","description":"FIN13 has injected fraudulent transactions into compromised networks that mimic legitimate behavior to siphon off incremental amounts of money.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1572","description":"FIN13 has utilized web shells and Java tools for tunneling capabilities to and from compromised assets.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1574.001","description":"FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1587.001","description":"FIN13 has utilized custom malware to maintain persistence in a compromised environment.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"},{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1588.002","description":"FIN13 has utilized publicly available tools such as Mimikatz, Impacket, PWdump7, ProcDump, Nmap, and Incognito V2 for targeting efforts.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]},{"technique_id":"T1589","description":"FIN13 has researched employees to target for social engineering attacks.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1590.004","description":"FIN13 has searched for infrastructure that can provide remote access to an environment for targeting efforts.","sources":[{"source":"Mandiant FIN13 Aug 2022","url":"https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"}]},{"technique_id":"T1657","description":"FIN13 has observed the victim's software and infrastructure over several months to understand the technical process of legitimate financial transactions, prior to attempting to conduct fraudulent transactions.","sources":[{"source":"Sygnia Elephant Beetle Jan 2022","url":"https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"}]}]},{"id":"G0085","name":"FIN4","procedures":[{"technique_id":"T1056.001","description":"FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.","sources":[{"source":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]},{"technique_id":"T1056.002","description":"FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials.","sources":[{"source":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]},{"technique_id":"T1059.005","description":"FIN4 has used VBA macros to display a dialog box and collect victim credentials.","sources":[{"source":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]},{"technique_id":"T1071.001","description":"FIN4 has used HTTP POST requests to transmit data.","sources":[{"source":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]},{"technique_id":"T1078","description":"FIN4 has used legitimate credentials to hijack email communications.","sources":[{"source":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]},{"technique_id":"T1090.003","description":"FIN4 has used Tor to log in to victims' email accounts.","sources":[{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]},{"technique_id":"T1114.002","description":"FIN4 has accessed and hijacked online email communications using stolen credentials.","sources":[{"source":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]},{"technique_id":"T1204.001","description":"FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).","sources":[{"source":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]},{"technique_id":"T1204.002","description":"FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).","sources":[{"source":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]},{"technique_id":"T1564.008","description":"FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked,\" \"phish,\" and “malware\" in a likely attempt to prevent organizations from communicating about their activities.","sources":[{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]},{"technique_id":"T1566.001","description":"FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.","sources":[{"source":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]},{"technique_id":"T1566.002","description":"FIN4 has used spearphishing emails (often sent from compromised accounts) containing malicious links.","sources":[{"source":"FireEye Hacking FIN4 Video Dec 2014","url":"https://www2.fireeye.com/WBNR-14Q4NAMFIN4.html"},{"source":"FireEye Hacking FIN4 Dec 2014","url":"https://web.archive.org/web/20220313062515/https://www.mandiant.com/sites/default/files/2021-09/rpt-fin4.pdf"}]}]},{"id":"G0053","name":"FIN5","procedures":[{"technique_id":"T1018","description":"FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets.","sources":[{"source":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"technique_id":"T1059","description":"FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.","sources":[{"source":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"technique_id":"T1070.004","description":"FIN5 uses SDelete to clean up the environment and attempt to prevent detection.","sources":[{"source":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"technique_id":"T1074.001","description":"FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.","sources":[{"source":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"technique_id":"T1078","description":"FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.","sources":[{"source":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"},{"source":"DarkReading FireEye FIN5 Oct 2015","url":"https://www.darkreading.com/analytics/prolific-cybercrime-gang-favors-legit-login-credentials/d/d-id/1322645?"},{"source":"FireEye Respond Webinar July 2017","url":"https://web.archive.org/web/20190304204552/https://www2.fireeye.com/WBNR-Are-you-ready-to-respond.html"}]},{"technique_id":"T1090.002","description":"FIN5 maintains access to victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel.","sources":[{"source":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"technique_id":"T1110","description":"FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.","sources":[{"source":"DarkReading FireEye FIN5 Oct 2015","url":"https://www.darkreading.com/analytics/prolific-cybercrime-gang-favors-legit-login-credentials/d/d-id/1322645?"},{"source":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"technique_id":"T1119","description":"FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.","sources":[{"source":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"technique_id":"T1133","description":"FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.","sources":[{"source":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"},{"source":"DarkReading FireEye FIN5 Oct 2015","url":"https://www.darkreading.com/analytics/prolific-cybercrime-gang-favors-legit-login-credentials/d/d-id/1322645?"},{"source":"FireEye Respond Webinar July 2017","url":"https://web.archive.org/web/20190304204552/https://www2.fireeye.com/WBNR-Are-you-ready-to-respond.html"}]},{"technique_id":"T1588.002","description":"FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.","sources":[{"source":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]},{"technique_id":"T1685.005","description":"FIN5 has cleared event logs from victims.","sources":[{"source":"Mandiant FIN5 GrrCON Oct 2016","url":"https://www.youtube.com/watch?v=fevGZs0EQu8"}]}]},{"id":"G0037","name":"FIN6","procedures":[{"technique_id":"T1003.001","description":"FIN6 has used Windows Credential Editor for credential dumping.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"},{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"technique_id":"T1003.003","description":"FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"},{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"technique_id":"T1005","description":"FIN6 has collected and exfiltrated payment card data from compromised systems.","sources":[{"source":"Trend Micro FIN6 October 2019","url":"https://www.trendmicro.com/en_us/research/19/j/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops.html"},{"source":"RiskIQ British Airways September 2018","url":"https://web.archive.org/web/20181231220607/https://riskiq.com/blog/labs/magecart-british-airways-breach/"},{"source":"RiskIQ Newegg September 2018","url":"https://web.archive.org/web/20181209083100/https://www.riskiq.com/blog/labs/magecart-newegg/"}]},{"technique_id":"T1018","description":"FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1021.001","description":"FIN6 used RDP to move laterally in victim networks.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"},{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"technique_id":"T1027.010","description":"FIN6 has used encoded PowerShell commands.","sources":[{"source":"Visa FIN6 Feb 2019","url":"https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"}]},{"technique_id":"T1036.004","description":"FIN6 has renamed the \"psexec\" service name to \"mstdc\" to masquerade as a legitimate Windows service.","sources":[{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"technique_id":"T1046","description":"FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1047","description":"FIN6 has used WMI to automate the remote execution of PowerShell scripts.","sources":[{"source":"Security Intelligence More Eggs Aug 2019","url":"https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"}]},{"technique_id":"T1048.003","description":"FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.","sources":[{"source":"Trend Micro FIN6 October 2019","url":"https://www.trendmicro.com/en_us/research/19/j/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops.html"}]},{"technique_id":"T1053.005","description":"FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and FrameworkPOS.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1059","description":"FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"},{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"technique_id":"T1059.001","description":"FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"},{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"},{"source":"Visa FIN6 Feb 2019","url":"https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"}]},{"technique_id":"T1059.003","description":"FIN6 has used kill.bat script to disable security tools.","sources":[{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"technique_id":"T1059.007","description":"FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.","sources":[{"source":"Trend Micro FIN6 October 2019","url":"https://www.trendmicro.com/en_us/research/19/j/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops.html"}]},{"technique_id":"T1068","description":"FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1070.004","description":"FIN6 has removed files from victim machines.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1074.002","description":"FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1078","description":"To move laterally on a victim network, FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"},{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"},{"source":"Visa FIN6 Feb 2019","url":"https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"}]},{"technique_id":"T1087.002","description":"FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1095","description":"FIN6 has used Metasploit Bind and Reverse TCP stagers.","sources":[{"source":"Trend Micro FIN6 October 2019","url":"https://www.trendmicro.com/en_us/research/19/j/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops.html"}]},{"technique_id":"T1102","description":"FIN6 has used Pastebin and Google Storage to host content for their operations.","sources":[{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"technique_id":"T1110.002","description":"FIN6 has extracted password hashes from ntds.dit to crack offline.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1119","description":"FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.","sources":[{"source":"Trend Micro FIN6 October 2019","url":"https://www.trendmicro.com/en_us/research/19/j/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops.html"},{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1134","description":"FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.","sources":[{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"technique_id":"T1204.002","description":"FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.","sources":[{"source":"Visa FIN6 Feb 2019","url":"https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"}]},{"technique_id":"T1213.006","description":"FIN6 has collected schemas and user accounts from systems running SQL Server.","sources":[{"source":"Visa FIN6 Feb 2019","url":"https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"}]},{"technique_id":"T1547.001","description":"FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1553.002","description":"FIN6 has used Comodo code-signing certificates.","sources":[{"source":"Security Intelligence More Eggs Aug 2019","url":"https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"}]},{"technique_id":"T1555","description":"FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.","sources":[{"source":"Visa FIN6 Feb 2019","url":"https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"}]},{"technique_id":"T1555.003","description":"FIN6 has used the Stealer One credential stealer to target web browsers.","sources":[{"source":"Visa FIN6 Feb 2019","url":"https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"}]},{"technique_id":"T1560","description":"Following data collection, FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1560.003","description":"FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.","sources":[{"source":"Trend Micro FIN6 October 2019","url":"https://www.trendmicro.com/en_us/research/19/j/fin6-compromised-e-commerce-platform-via-magecart-to-inject-credit-card-skimmers-into-thousands-of-online-shops.html"},{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1566.001","description":"FIN6 has targeted victims with e-mails containing malicious attachments.","sources":[{"source":"Visa FIN6 Feb 2019","url":"https://usa.visa.com/dam/VCOM/global/support-legal/documents/fin6-cybercrime-group-expands-threat-To-ecommerce-merchants.pdf"}]},{"technique_id":"T1566.003","description":"FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.","sources":[{"source":"Security Intelligence More Eggs Aug 2019","url":"https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"}]},{"technique_id":"T1569.002","description":"FIN6 has created Windows services to execute encoded PowerShell commands.","sources":[{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"technique_id":"T1572","description":"FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1573.002","description":"FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.","sources":[{"source":"FireEye FIN6 April 2016","url":"https://web.archive.org/web/20190807112824/https://www2.fireeye.com/rs/848-DID-242/images/rpt-fin6.pdf"}]},{"technique_id":"T1588.002","description":"FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.","sources":[{"source":"Security Intelligence More Eggs Aug 2019","url":"https://securityintelligence.com/posts/more_eggs-anyone-threat-actor-itg08-strikes-again/"},{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]},{"technique_id":"T1685","description":"FIN6 has deployed a utility script named kill.bat to disable anti-virus.","sources":[{"source":"FireEye FIN6 Apr 2019","url":"https://www.fireeye.com/blog/threat-research/2019/04/pick-six-intercepting-a-fin6-intrusion.html"}]}]},{"id":"G0046","name":"FIN7","procedures":[{"technique_id":"T1005","description":"FIN7 has collected files and other sensitive information from a compromised network.","sources":[{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1008","description":"FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"}]},{"technique_id":"T1021.001","description":"FIN7 has used RDP to move laterally in victim environments.","sources":[{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1021.004","description":"FIN7 has used SSH to move laterally through victim environments.","sources":[{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1021.005","description":"FIN7 has used TightVNC to control compromised hosts.","sources":[{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1027.010","description":"FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.","sources":[{"source":"FireEye Obfuscation June 2017","url":"https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"},{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"},{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1027.016","description":"FIN7 has used random junk code to obfuscate malware code.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"}]},{"technique_id":"T1033","description":"FIN7 has used the command cmd.exe /C quser to collect user session information.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"}]},{"technique_id":"T1036.004","description":"FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.","sources":[]},{"technique_id":"T1036.005","description":"FIN7 has attempted to run Darkside ransomware with the filename sleep.exe. Additionally, FIN7 has mimicked WsTaskLoad.exe, which is associated with the Wondershare software suite, by using a malicious executable under the same name.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1047","description":"FIN7 has used WMI to install malware on targeted systems.","sources":[{"source":"eSentire FIN7 July 2021","url":"https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc"}]},{"technique_id":"T1053.005","description":"FIN7 malware has created scheduled tasks to establish persistence. Specifically, FIN7 has used OpenSSH to establish persistence.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"},{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"},{"source":"Flashpoint FIN 7 March 2019","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"}]},{"technique_id":"T1057","description":"FIN7 has used the PowerShell script 3CF9.ps1 to perform process discovery by executing tasklist /v. Additionally, WsTaskLoad.exe executes tasklist /v to perform process discovery.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"technique_id":"T1059","description":"FIN7 used SQL scripts to help perform tasks on the victim's machine.","sources":[{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"},{"source":"Flashpoint FIN 7 March 2019","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"}]},{"technique_id":"T1059.001","description":"FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload. Additionally, FIN7 has executed a custom obfuscation of the shellcode invoker in PowerSploit called POWERTRASH.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"},{"source":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"},{"source":"Gemini_FIN7_Jan2022","url":"https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/"},{"source":"FBI Flash FIN7 USB","url":"https://therecord.media/fbi-fin7-hackers-target-us-companies-with-badusb-devices-to-install-ransomware/"}]},{"technique_id":"T1059.003","description":"FIN7 used the command prompt to launch commands on the victim’s machine. Additionally, FIN7 has used cmd.exe to open the Run dialog by sending the “Windows + R” keys through malicious USBs acting as virtual keyboards.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"},{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"},{"source":"Gemini_FIN7_Jan2022","url":"https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/"},{"source":"Flashpoint FIN 7 March 2019","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"}]},{"technique_id":"T1059.005","description":"FIN7 used VBS scripts to help perform tasks on the victim's machine.","sources":[{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"},{"source":"Flashpoint FIN 7 March 2019","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"},{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1059.007","description":"FIN7 used JavaScript scripts to help perform tasks on the victim's machine.","sources":[{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"},{"source":"Flashpoint FIN 7 March 2019","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"}]},{"technique_id":"T1069.002","description":"FIN7 has used the command net group \"domain admins\" /domain to enumerate domain groups.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"}]},{"technique_id":"T1071.004","description":"FIN7 has performed C2 using DNS via A, OPT, and TXT records.","sources":[{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"}]},{"technique_id":"T1078","description":"FIN7 has harvested valid administrative credentials for lateral movement.","sources":[{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1078.003","description":"FIN7 has used compromised credentials for access as SYSTEM on Exchange servers.","sources":[{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1082","description":"FIN7 has used csvde.exe, which is a built-in Windows command line tool, to export system information. Additionally, WsTaskLoad has gathered system information, such as operating system and hostname.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"technique_id":"T1087.002","description":"FIN7 has used the PowerShell script 3CF9.ps1 and the executable WsTaskLoad to enumerate domain administrations by executing net group “Domain Admins” /domain. FIN7 has also used csvde.exe, which is a built-in Windows command line tool, to export Active Directory information.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"technique_id":"T1091","description":"FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations. Additionally, FIN7 has used malicious USBs that acted as virtual keyboards to install malware and txt files that decode to PowerShell commands.","sources":[{"source":"Gemini_FIN7_Jan2022","url":"https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/"},{"source":"FBI Flash FIN7 USB","url":"https://therecord.media/fbi-fin7-hackers-target-us-companies-with-badusb-devices-to-install-ransomware/"}]},{"technique_id":"T1102.002","description":"FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.","sources":[{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"}]},{"technique_id":"T1105","description":"FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"},{"source":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"},{"source":"DOJ FIN7 Aug 2018","url":"https://www.justice.gov/opa/press-release/file/1084361/download"},{"source":"Gemini_FIN7_Jan2022","url":"https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/"}]},{"technique_id":"T1113","description":"FIN7 captured screenshots and desktop video recordings.","sources":[{"source":"DOJ FIN7 Aug 2018","url":"https://www.justice.gov/opa/press-release/file/1084361/download"}]},{"technique_id":"T1124","description":"FIN7 has used the PowerShell script 3CF9.ps1 to execute net time.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"technique_id":"T1125","description":"FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment.","sources":[{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"},{"source":"DOJ FIN7 Aug 2018","url":"https://www.justice.gov/opa/press-release/file/1084361/download"}]},{"technique_id":"T1140","description":"FIN7 has decoded a malicious PowerShell script using certutil -decode hex and has decoded an XOR-obfuscated block of data with the key qawsed1q2w3e, which led to the installation of Lizar.","sources":[{"source":"Gemini_FIN7_Jan2022","url":"https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/"}]},{"technique_id":"T1190","description":"FIN7 has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange.","sources":[{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1195.002","description":"FIN7 has gained initial access by compromising a victim's software supply chain.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"}]},{"technique_id":"T1204.001","description":"FIN7 has used malicious links to lure victims into downloading malware.","sources":[{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1204.002","description":"FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file. Additionally, FIN7 has used malicious Microsoft Word and Excel files and Leo VBS to distribute an updated version of JSS Loader and to distribute the Harpy backdoor.","sources":[{"source":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"},{"source":"eSentire FIN7 July 2021","url":"https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc"},{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"},{"source":"Crowdstrike_CarbonSpider_Part2_Nov2024","url":"https://www.crowdstrike.com/en-us/blog/carbon-spider-embraces-big-game-hunting-part-2/"}]},{"technique_id":"T1210","description":"FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.","sources":[{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1218.005","description":"FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.","sources":[{"source":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"}]},{"technique_id":"T1218.011","description":"FIN7 has used rundll32.exe to execute malware on a compromised network.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"}]},{"technique_id":"T1219","description":"FIN7 has utilized the remote management tool Atera to download malware to a compromised system.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"}]},{"technique_id":"T1486","description":"FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware. Additionally, FIN7 has deployed ransomware as the end payload during big game hunting.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"},{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1497.002","description":"FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.","sources":[{"source":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"}]},{"technique_id":"T1543.003","description":"FIN7 created new Windows services and added them to the startup directories for persistence.","sources":[{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"}]},{"technique_id":"T1546.011","description":"FIN7 has used application shim databases for persistence.","sources":[{"source":"FireEye FIN7 Shim Databases","url":"https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html"}]},{"technique_id":"T1547.001","description":"FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.","sources":[{"source":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"},{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"}]},{"technique_id":"T1553.002","description":"FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.","sources":[{"source":"FireEye CARBANAK June 2017","url":"https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"},{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"}]},{"technique_id":"T1558.003","description":"FIN7 has used Kerberoasting PowerShell commands such as, Invoke-Kerberoast for credential access and to enable lateral movement.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"},{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1559.002","description":"FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.","sources":[{"source":"CyberScoop FIN7 Oct 2017","url":"https://www.cyberscoop.com/fin7-dde-morphisec-fileless-malware/"}]},{"technique_id":"T1564.001","description":"FIN7 has used attrib +h “C:\\ProgramData\\ssh” to make the SSH folder hidden.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"technique_id":"T1564.003","description":"FIN7 has used .txt files to conceal PowerShell commands.","sources":[{"source":"Gemini_FIN7_Jan2022","url":"https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/"}]},{"technique_id":"T1566.001","description":"FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.","sources":[{"source":"FireEye FIN7 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"},{"source":"DOJ FIN7 Aug 2018","url":"https://www.justice.gov/opa/press-release/file/1084361/download"},{"source":"eSentire FIN7 July 2021","url":"https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc"},{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"},{"source":"Flashpoint FIN 7 March 2019","url":"https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/"}]},{"technique_id":"T1566.002","description":"FIN7 has conducted broad phishing campaigns using malicious links. Additionally, FIN7 has sent spearphishing emails containing a typosquatted link to “ip-sccanner[.]com.”","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1567.002","description":"FIN7 has exfiltrated stolen data to the MEGA file sharing site.","sources":[{"source":"CrowdStrike Carbon Spider August 2021","url":"https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"}]},{"technique_id":"T1569.002","description":"FIN7 has started the SSH service by executing sc start sshd.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"technique_id":"T1571","description":"FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2. FIN7 has used TCP ports 59999 and 9898 for firewall rules.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source":"FireEye FIN7 Aug 2018","url":"https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"}]},{"technique_id":"T1572","description":"FIN7 has tunneled C2 traffic via OpenSSH.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"technique_id":"T1583.001","description":"FIN7 has registered look-alike domains for use in phishing campaigns. Additionally, FIN7 has registered a malicious domain as advanced-ip-sccanner[.]com that redirected to an adversary-controlled Dropbox which contained the malicious executable.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"},{"source":"eSentire FIN7 July 2021","url":"https://www.esentire.com/security-advisories/notorious-cybercrime-gang-fin7-lands-malware-in-law-firm-using-fake-legal-complaint-against-jack-daniels-owner-brown-forman-inc"}]},{"technique_id":"T1583.006","description":"FIN7 has set up Amazon S3 buckets to host trojanized digital products.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"}]},{"technique_id":"T1587.001","description":"FIN7 has developed malware for use in operations, including the creation of infected removable media.","sources":[{"source":"FBI Flash FIN7 USB","url":"https://therecord.media/fbi-fin7-hackers-target-us-companies-with-badusb-devices-to-install-ransomware/"},{"source":"FireEye FIN7 Oct 2019","url":"https://www.fireeye.com/blog/threat-research/2019/10/mahalo-fin7-responding-to-new-tools-and-techniques.html"}]},{"technique_id":"T1588.002","description":"FIN7 has utilized a variety of tools such as Cobalt Strike, PowerSploit, and the remote management tool, Atera for targeting efforts.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"}]},{"technique_id":"T1591","description":"FIN7 has compiled a list of victims by filtering companies by revenue using Zoominfo, which is a service that provides business information.","sources":[{"source":"BiZone Lizar May 2021","url":"https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"}]},{"technique_id":"T1591.004","description":"FIN7 has identified IT staff and employees who had higher levels of administrative rights.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"technique_id":"T1608.001","description":"FIN7 has staged legitimate software, that was trojanized to contain an Atera agent installer, on Amazon S3. FIN7 has also used an open directory web server as a staging server for payloads and other tools, such as OpenSSH and 7zip.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"},{"source":"Cocomazzi FIN7 Reboot","url":"https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/"}]},{"technique_id":"T1608.004","description":"FIN7 has compromised a digital product website and modified multiple download links to point to trojanized versions of offered digital products.","sources":[{"source":"Mandiant FIN7 Apr 2022","url":"https://www.mandiant.com/resources/evolution-of-fin7"}]},{"technique_id":"T1608.005","description":"FIN7 has created a fake link that redirected to an adversary-controlled Dropbox that downloaded the malicious executable.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]},{"technique_id":"T1620","description":"FIN7 has loaded a .NET assembly into the currect execution context via Reflection.Assembly::Load.","sources":[{"source":"Gemini_FIN7_Jan2022","url":"https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/"}]},{"technique_id":"T1674","description":"FIN7 has used malicious USBs to emulate keystrokes to launch PowerShell to download and execute malware from the adversary's server.","sources":[{"source":"Gemini_FIN7_Jan2022","url":"https://geminiadvisory.io/fin7-flash-drives-spread-remote-access-trojan/"},{"source":"FBI Flash FIN7 USB","url":"https://therecord.media/fbi-fin7-hackers-target-us-companies-with-badusb-devices-to-install-ransomware/"}]},{"technique_id":"T1686","description":"FIN7 has added a firewall rule to allow TCP port 59999 inbound and a rule to allow sshd.exe on TCP port 9898.","sources":[{"source":"BlackBerry_FIN7_April2024","url":"https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry"}]}]},{"id":"G0061","name":"FIN8","procedures":[{"technique_id":"T1003.001","description":"FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1016.001","description":"FIN8 has used the Ping command to check connectivity to actor-controlled C2 servers.","sources":[{"source":"Bitdefender Sardonic Aug 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}]},{"technique_id":"T1018","description":"FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"}]},{"technique_id":"T1021.001","description":"FIN8 has used RDP for lateral movement.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1021.002","description":"FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context. FIN8 has also used smbexec from the Impacket suite for lateral movement.","sources":[{"source":"Bitdefender Sardonic Aug 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"},{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1027.010","description":"FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.","sources":[{"source":"FireEye Obfuscation June 2017","url":"https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"},{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"}]},{"technique_id":"T1033","description":"FIN8 has executed the command quser to display the session details of a compromised machine.","sources":[{"source":"Symantec FIN8 Jul 2023","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"technique_id":"T1047","description":"FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.","sources":[{"source":"FireEye Obfuscation June 2017","url":"https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"},{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"},{"source":"Symantec FIN8 Jul 2023","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"technique_id":"T1048.003","description":"FIN8 has used FTP to exfiltrate collected data.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1053.005","description":"FIN8 has used scheduled tasks to maintain RDP backdoors.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1055.004","description":"FIN8 has injected malicious code into a new svchost.exe process.","sources":[{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"}]},{"technique_id":"T1059.001","description":"FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.","sources":[{"source":"FireEye Obfuscation June 2017","url":"https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"},{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"},{"source":"Symantec FIN8 Jul 2023","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"technique_id":"T1059.003","description":"FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via cmd.exe.","sources":[{"source":"FireEye Obfuscation June 2017","url":"https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"},{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"},{"source":"Symantec FIN8 Jul 2023","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"technique_id":"T1068","description":"FIN8 has exploited the CVE-2016-0167 local vulnerability.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source":"FireEye Fin8 May 2016","url":"https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"}]},{"technique_id":"T1070.004","description":"FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source":"Symantec FIN8 Jul 2023","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"technique_id":"T1071.001","description":"FIN8 has used HTTPS for command and control.","sources":[{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"}]},{"technique_id":"T1074.002","description":"FIN8 aggregates staged data from a network into a single location.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1078","description":"FIN8 has used valid accounts for persistence and lateral movement.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1082","description":"FIN8 has used PowerShell Scripts to check the architecture of a compromised machine before the selection of a 32-bit or 64-bit version of a malicious .NET loader.","sources":[{"source":"Symantec FIN8 Jul 2023","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"technique_id":"T1102","description":"FIN8 has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.","sources":[{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"}]},{"technique_id":"T1105","description":"FIN8 has used remote code execution to download subsequent payloads.","sources":[{"source":"FireEye Fin8 May 2016","url":"https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"},{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"}]},{"technique_id":"T1112","description":"FIN8 has deleted Registry keys during post compromise cleanup activities.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1134.001","description":"FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.","sources":[{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"},{"source":"Symantec FIN8 Jul 2023","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"technique_id":"T1204.001","description":"FIN8 has used emails with malicious links to lure victims into installing malware.","sources":[{"source":"FireEye Obfuscation June 2017","url":"https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"},{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source":"FireEye Fin8 May 2016","url":"https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"}]},{"technique_id":"T1204.002","description":"FIN8 has used malicious e-mail attachments to lure victims into executing malware.","sources":[{"source":"FireEye Obfuscation June 2017","url":"https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"},{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source":"FireEye Fin8 May 2016","url":"https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"}]},{"technique_id":"T1482","description":"FIN8 has retrieved a list of trusted domains by using nltest.exe /domain_trusts.","sources":[{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"}]},{"technique_id":"T1486","description":"FIN8 has deployed ransomware such as Ragnar Locker, White Rabbit, and attempted to execute Noberus on compromised networks.","sources":[{"source":"Symantec FIN8 Jul 2023","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"}]},{"technique_id":"T1518.001","description":"FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1546.003","description":"FIN8 has used WMI event subscriptions for persistence.","sources":[{"source":"Bitdefender FIN8 July 2021","url":"https://businessinsights.bitdefender.com/deep-dive-into-a-fin8-attack-a-forensic-investigation"}]},{"technique_id":"T1560.001","description":"FIN8 has used RAR to compress collected data before exfiltration.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1566.001","description":"FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.","sources":[{"source":"FireEye Obfuscation June 2017","url":"https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"},{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"},{"source":"FireEye Fin8 May 2016","url":"https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"}]},{"technique_id":"T1566.002","description":"FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1573.002","description":"FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]},{"technique_id":"T1588.002","description":"FIN8 has used open-source tools such as Impacket for targeting efforts.","sources":[{"source":"Bitdefender Sardonic Aug 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}]},{"technique_id":"T1588.003","description":"FIN8 has used an expired open-source X.509 certificate for testing in the OpenSSL repository, to connect to actor-controlled C2 servers.","sources":[{"source":"Bitdefender Sardonic Aug 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"}]},{"technique_id":"T1685.005","description":"FIN8 has cleared logs during post compromise cleanup activities.","sources":[{"source":"FireEye Know Your Enemy FIN8 Aug 2016","url":"https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html"}]}]},{"id":"G0117","name":"Fox Kitten","procedures":[{"technique_id":"T1003.001","description":"Fox Kitten has used prodump to dump credentials from LSASS.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1003.003","description":"Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1005","description":"Fox Kitten has searched local system resources to access sensitive documents.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1012","description":"Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1018","description":"Fox Kitten has used Angry IP Scanner to detect remote systems.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1021.001","description":"Fox Kitten has used RDP to log in and move laterally in the target environment.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"technique_id":"T1021.002","description":"Fox Kitten has used valid accounts to access SMB shares.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1021.004","description":"Fox Kitten has used the PuTTY and Plink tools for lateral movement.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1021.005","description":"Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1027.010","description":"Fox Kitten has base64 encoded scripts to avoid detection.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1027.013","description":"Fox Kitten has base64 encoded payloads to avoid detection.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1036.004","description":"Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1036.005","description":"Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1039","description":"Fox Kitten has searched network shares to access sensitive documents.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1046","description":"Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"technique_id":"T1053.005","description":"Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"technique_id":"T1059","description":"Fox Kitten has used a Perl reverse shell to communicate with C2.","sources":[{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"technique_id":"T1059.001","description":"Fox Kitten has used PowerShell scripts to access credential data.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1059.003","description":"Fox Kitten has used cmd.exe likely as a password changing mechanism.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1078","description":"Fox Kitten has used valid credentials with various services during lateral movement.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1083","description":"Fox Kitten has used WizTree to obtain network files and directory listings.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1087.001","description":"Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1087.002","description":"Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1090","description":"Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"},{"source":"Check Point Pay2Key November 2020","url":"https://research.checkpoint.com/2020/ransomware-alert-pay2key/"}]},{"technique_id":"T1102","description":"Fox Kitten has used Amazon Web Services to host C2.","sources":[{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"technique_id":"T1105","description":"Fox Kitten has downloaded additional tools including PsExec directly to endpoints.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1110","description":"Fox Kitten has brute forced RDP credentials.","sources":[{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"technique_id":"T1136.001","description":"Fox Kitten has created a local user account with administrator privileges.","sources":[{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"technique_id":"T1190","description":"Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.","sources":[{"source":"ClearkSky Fox Kitten February 2020","url":"https://www.clearskysec.com/fox-kitten/"},{"source":"Dragos PARISITE ","url":"https://www.dragos.com/threat/parisite/"},{"source":"CrowdStrike PIONEER KITTEN August 2020","url":"https://www.crowdstrike.com/blog/who-is-pioneer-kitten/"},{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"technique_id":"T1210","description":"Fox Kitten has exploited known vulnerabilities in remote services including RDP.","sources":[{"source":"ClearkSky Fox Kitten February 2020","url":"https://www.clearskysec.com/fox-kitten/"},{"source":"CrowdStrike PIONEER KITTEN August 2020","url":"https://www.crowdstrike.com/blog/who-is-pioneer-kitten/"},{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"technique_id":"T1213.005","description":"Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1217","description":"Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1505.003","description":"Fox Kitten has installed web shells on compromised hosts to maintain access.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"technique_id":"T1530","description":"Fox Kitten has obtained files from the victim's cloud storage instances.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1546.008","description":"Fox Kitten has used sticky keys to launch a command prompt.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1552.001","description":"Fox Kitten has accessed files to gain valid credentials.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1555.005","description":"Fox Kitten has used scripts to access credential information from the KeePass database.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1560.001","description":"Fox Kitten has used 7-Zip to archive data.","sources":[{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"}]},{"technique_id":"T1572","description":"Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as ngrok and custom tool SSHMinion.","sources":[{"source":"CrowdStrike PIONEER KITTEN August 2020","url":"https://www.crowdstrike.com/blog/who-is-pioneer-kitten/"},{"source":"CISA AA20-259A Iran-Based Actor September 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-259a"},{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]},{"technique_id":"T1585","description":"Fox Kitten has created KeyBase accounts to communicate with ransomware victims.","sources":[{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"},{"source":"Check Point Pay2Key November 2020","url":"https://research.checkpoint.com/2020/ransomware-alert-pay2key/"}]},{"technique_id":"T1585.001","description":"Fox Kitten has used a Twitter account to communicate with ransomware victims.","sources":[{"source":"ClearSky Pay2Kitten December 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/12/Pay2Kitten.pdf"}]}]},{"id":"G0093","name":"GALLIUM","procedures":[{"technique_id":"T1003.001","description":"GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"},{"source":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"technique_id":"T1003.002","description":"GALLIUM used reg commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1005","description":"GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1016","description":"GALLIUM used ipconfig /all to obtain information about the victim network configuration. The group also ran a modified version of NBTscan to identify available NetBIOS name servers.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1018","description":"GALLIUM used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as ping to identify remote systems.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1027","description":"GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1027.002","description":"GALLIUM packed some payloads using different types of packers, both known and custom.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1027.005","description":"GALLIUM ensured each payload had a unique hash, including by using different types of packers.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1033","description":"GALLIUM used whoami and query user to obtain information about the victim user.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1036.003","description":"GALLIUM used a renamed cmd.exe file to evade detection.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1041","description":"GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1047","description":"GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1049","description":"GALLIUM used netstat -oan to obtain information about the victim network connections.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1053.005","description":"GALLIUM established persistence for PoisonIvy by created a scheduled task.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1059.001","description":"GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1059.003","description":"GALLIUM used the Windows command shell to execute commands.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1074.001","description":"GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1078","description":"GALLIUM leveraged valid accounts to maintain access to a victim network.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1090.002","description":"GALLIUM used a modified version of HTRAN to redirect connections between networks.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1105","description":"GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"},{"source":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"technique_id":"T1133","description":"GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"},{"source":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"technique_id":"T1136.002","description":"GALLIUM created high-privileged domain user accounts to maintain access to victim networks.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"},{"source":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"technique_id":"T1190","description":"GALLIUM exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"},{"source":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"technique_id":"T1505.003","description":"GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"},{"source":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"technique_id":"T1550.002","description":"GALLIUM used dumped hashes to authenticate to other machines via pass the hash.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1553.002","description":"GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.","sources":[{"source":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"technique_id":"T1560.001","description":"GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"},{"source":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"technique_id":"T1570","description":"GALLIUM has used PsExec to move laterally between hosts in the target network.","sources":[{"source":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"technique_id":"T1574.001","description":"GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.","sources":[{"source":"Cybereason Soft Cell June 2019","url":"https://www.cybereason.com/blog/operation-soft-cell-a-worldwide-campaign-against-telecommunications-providers"}]},{"technique_id":"T1583.004","description":"GALLIUM has used Taiwan-based servers that appear to be exclusive to GALLIUM.","sources":[{"source":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]},{"technique_id":"T1588.002","description":"GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.","sources":[{"source":"Microsoft GALLIUM December 2019","url":"https://www.microsoft.com/security/blog/2019/12/12/gallium-targeting-global-telecom/"}]}]},{"id":"G0084","name":"Gallmaker","procedures":[{"technique_id":"T1027","description":"Gallmaker obfuscated shellcode used during execution.","sources":[{"source":"Symantec Gallmaker Oct 2018","url":"https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"}]},{"technique_id":"T1059.001","description":"Gallmaker used PowerShell to download additional payloads and for execution.","sources":[{"source":"Symantec Gallmaker Oct 2018","url":"https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"}]},{"technique_id":"T1204.002","description":"Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution.","sources":[{"source":"Symantec Gallmaker Oct 2018","url":"https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"}]},{"technique_id":"T1559.002","description":"Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.","sources":[{"source":"Symantec Gallmaker Oct 2018","url":"https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"}]},{"technique_id":"T1560.001","description":"Gallmaker has used WinZip, likely to archive data prior to exfiltration.","sources":[{"source":"Symantec Gallmaker Oct 2018","url":"https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"}]},{"technique_id":"T1566.001","description":"Gallmaker sent emails with malicious Microsoft Office documents attached.","sources":[{"source":"Symantec Gallmaker Oct 2018","url":"https://www.symantec.com/blogs/threat-intelligence/gallmaker-attack-group"}]}]},{"id":"G0047","name":"Gamaredon Group","procedures":[{"technique_id":"T1001","description":"Gamaredon Group has used obfuscated VBScripts with randomly generated variable names and concatenated strings.","sources":[{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"technique_id":"T1005","description":"Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"technique_id":"T1012","description":"Gamaredon Group has queried HKEY_CURRENT_USER\\\\Console\\\\WindowsUpdates to obtain the C2 addresses. Gamaredon Group has queried HKEY_CURRENT_USER\\\\Console\\\\WindowsUpdates to obtain the C2 addresses.","sources":[{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1016.001","description":"Gamaredon Group has tested connectivity between a compromised machine and a C2 server using Ping with commands such as CSIDL_SYSTEM\\cmd.exe /c ping -n 1. Gamaredon Group has searched the ping records to obtain the C2 address and has used ping to search for the C2’s status.","sources":[{"source":"Symantec Shuckworm January 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1020","description":"Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}]},{"technique_id":"T1021.005","description":"Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.","sources":[{"source":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source":"Symantec Shuckworm January 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"},{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"technique_id":"T1025","description":"A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"technique_id":"T1027","description":"Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments. Additionally, Gamaredon Group has used an obfuscated .drv file.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1027.004","description":"Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}]},{"technique_id":"T1027.010","description":"Gamaredon Group has used obfuscated or encrypted scripts.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1027.012","description":"Gamaredon Group has used LNK files to hide malicious scripts for execution.","sources":[{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"},{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1027.015","description":"Gamaredon Group has delivered malicious payloads within compressed archives and zip files.","sources":[{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1027.016","description":"Gamaredon Group has obfuscated .NET executables by inserting junk code.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}]},{"technique_id":"T1033","description":"A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.","sources":[{"source":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"}]},{"technique_id":"T1036.005","description":"Gamaredon Group has used legitimate process names to hide malware including svchosst. Additionally, Gamaredon Group disguised malicious ZIP archives as Office documents that are related to the invasion.","sources":[{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"},{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1039","description":"Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"technique_id":"T1041","description":"A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.","sources":[{"source":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1047","description":"Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address. Gamaredon Group has used the following WMI query to search for a ping record: Select * From Win32_PingStatus where Address = 'mil.gov.ua'.","sources":[{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"technique_id":"T1053.005","description":"Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"technique_id":"T1055","description":"Gamaredon Group has injected Remcos into explorer.exe.","sources":[{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1057","description":"Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.","sources":[{"source":"Symantec Shuckworm January 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"},{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"technique_id":"T1059.001","description":"Gamaredon Group has used obfuscated PowerShell scripts for staging. Additionally, (LinkById : G0047) has used PowerShell based tools later in its attack chain. Additionally, Gamaredon Group has used the PowerShell cmdlet Get-Command to download and execute the next stage payload.","sources":[{"source":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"},{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1059.003","description":"Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.","sources":[{"source":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"technique_id":"T1059.005","description":"Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros. Additionally, Gamaredon Group has executed VBScript files using wscript.exe.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"TrendMicro Gamaredon April 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"Secureworks IRON TILDEN Profile","url":"https://www.secureworks.com/research/threat-profiles/iron-tilden"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1070.004","description":"Gamaredon Group tools can delete files used during an operation.","sources":[{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"TrendMicro Gamaredon April 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"Symantec Shuckworm January 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"}]},{"technique_id":"T1071.001","description":"Gamaredon Group has used HTTP and HTTPS for C2 communications.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"TrendMicro Gamaredon April 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"Symantec Shuckworm January 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"},{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"},{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1080","description":"Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}]},{"technique_id":"T1082","description":"A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.","sources":[{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"TrendMicro Gamaredon April 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1083","description":"Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system. Gamaredon Group has also identified directory trees, folders and files on the compromised host.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"},{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"technique_id":"T1090","description":"Gamaredon Group has used the Cloudflare Tunnel client to proxy C2 traffic.","sources":[{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"technique_id":"T1090.003","description":"Gamaredon Group has used Tor for C2 traffic.","sources":[{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1091","description":"Gamaredon Group has replicated to removable media by leveraging the User Assist Reg Key and creating LNKs on all network and removable drives available on the infected host.","sources":[{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1095","description":"Gamaredon Group has used SOCKS5 over port 9050 for C2 communication.","sources":[{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1102","description":"Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}]},{"technique_id":"T1102.002","description":"Gamaredon Group has used several ways to try to resolve the C2 server, including: public third-party websites, an adversary-operated Telegraph channel, the ngrok utility and the TXT record of a hardcoded C2 domain.","sources":[{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1102.003","description":"Gamaredon Group has used Telegram Messenger content to discover the IP address for C2 communications.","sources":[{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"technique_id":"T1105","description":"Gamaredon Group has downloaded additional malware and tools onto a compromised host. For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"TrendMicro Gamaredon April 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"},{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1106","description":"Gamaredon Group malware has used CreateProcess to launch additional malicious components.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"technique_id":"T1112","description":"Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\\Software\\Microsoft\\Office\\<version>\\<product>\\Security\\VBAWarnings and HKCU\\Software\\Microsoft\\Office\\<version>\\<product>\\Security\\AccessVBOM. Gamaredon Group has also modified Registry keys to hide folders and system files and to add the C2 address under HKEY_CURRENT_USER\\Console\\WindowsUpdate.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1113","description":"Gamaredon Group's malware can take screenshots of the compromised computer every minute.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1119","description":"Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}]},{"technique_id":"T1120","description":"Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"Palo Alto Gamaredon Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit-42-title-gamaredon-group-toolset-evolution/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"technique_id":"T1137","description":"Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}]},{"technique_id":"T1140","description":"Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded Base64-encoded source code of a downloader. Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"TrendMicro Gamaredon April 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"technique_id":"T1204.001","description":"Gamaredon Group has attempted to get users to click on a link pointing to a malicious HTML file leading to follow-on malicious content.","sources":[{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"technique_id":"T1204.002","description":"Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded. Gamaredon Group has also attempted to get users to click on thematically named files.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"TrendMicro Gamaredon April 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source":"Secureworks IRON TILDEN Profile","url":"https://www.secureworks.com/research/threat-profiles/iron-tilden"},{"source":"Symantec Shuckworm January 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"},{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"},{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1218.005","description":"Gamaredon Group has used mshta.exe to execute malicious files.","sources":[{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"Symantec Shuckworm January 2022","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/shuckworm-gamaredon-espionage-ukraine"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"technique_id":"T1218.011","description":"Gamaredon Group malware has used rundll32 to launch additional malicious components.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}]},{"technique_id":"T1221","description":"Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"TrendMicro Gamaredon April 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source":"Proofpoint RTF Injection","url":"https://www.proofpoint.com/us/blog/threat-insight/injection-new-black-novel-rtf-template-inject-technique-poised-widespread"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"Secureworks IRON TILDEN Profile","url":"https://www.secureworks.com/research/threat-profiles/iron-tilden"},{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"technique_id":"T1480","description":"Gamaredon Group has used geoblocking to limit downloads of the malicious file to specific geographic locations.","sources":[{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"},{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1491.001","description":"Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.","sources":[{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"}]},{"technique_id":"T1497.001","description":"Gamaredon Group has checked existing conditions, such as geographic location, device type, or system specification, before the victim is sent a malicious Word document.","sources":[{"source":"SilentPush_GamaredonFastFlux_Sept2023","url":"https://www.silentpush.com/blog/from-russia-with-a-71/"}]},{"technique_id":"T1518.001","description":"Gamaredon Group has used PowerShell scripts to identify security software on the victim machine.","sources":[{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1534","description":"Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"}]},{"technique_id":"T1547.001","description":"Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"TrendMicro Gamaredon April 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"technique_id":"T1559.001","description":"Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]},{"technique_id":"T1561.001","description":"Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.","sources":[{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"}]},{"technique_id":"T1564.003","description":"Gamaredon Group has used hidcon to run batch files in a hidden console window. Gamaredon Group has also executed PowerShell in a hidden window.","sources":[{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"},{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1566.001","description":"Gamaredon Group has delivered spearphishing emails with malicious attachments to targets. Additionally, Gamaredon Group has distributed malicious LNK files compressed in ZIP archives.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"CERT-EE Gamaredon January 2021","url":"https://www.ria.ee/sites/default/files/content-editors/kuberturve/tale_of_gamaredon_infection.pdf"},{"source":"TrendMicro Gamaredon April 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/gamaredon-apt-group-use-covid-19-lure-in-campaigns/"},{"source":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"Secureworks IRON TILDEN Profile","url":"https://www.secureworks.com/research/threat-profiles/iron-tilden"},{"source":"SilentPush_GamaredonFastFlux_Sept2023","url":"https://www.silentpush.com/blog/from-russia-with-a-71/"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"},{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"},{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1568","description":"Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.","sources":[{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"technique_id":"T1568.001","description":"Gamaredon Group has used fast flux DNS to mask their command and control channel behind rotating IP addresses. Additionally, Gamaredon Group has used a low-frequency variant of the single-flux method.","sources":[{"source":"Huntio_GamaredonFlux_Apr2025","url":"https://hunt.io/blog/state-sponsored-activity-gamaredon-shadowpad"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"SilentPush_GamaredonFastFlux_Sept2023","url":"https://www.silentpush.com/blog/from-russia-with-a-71/"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"technique_id":"T1571","description":"Gamaredon Group has used port 6856 for C2 communications.","sources":[{"source":"VenereCiscoTalos_Gamaredon_Mar2025","url":"https://blog.talosintelligence.com/gamaredon-campaign-distribute-remcos/"}]},{"technique_id":"T1583.001","description":"Gamaredon Group has registered multiple domains to facilitate payload staging and C2.","sources":[{"source":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"},{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"technique_id":"T1583.003","description":"Gamaredon Group has used VPS hosting providers for infrastructure outside of Russia.","sources":[{"source":"Huntio_GamaredonFlux_Apr2025","url":"https://hunt.io/blog/state-sponsored-activity-gamaredon-shadowpad"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"technique_id":"T1583.006","description":"Gamaredon Group has used Cloudflare’s TryClouldflare service to obtain C2 nodes.","sources":[{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1587.003","description":"Gamaredon Group has used the same TLS certificate across its infrastructure.","sources":[{"source":"Huntio_GamaredonFlux_Apr2025","url":"https://hunt.io/blog/state-sponsored-activity-gamaredon-shadowpad"}]},{"technique_id":"T1588.002","description":"Gamaredon Group has used various legitimate tools, such as mshta.exe and Reg, and services during operations.","sources":[{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"},{"source":"unit42_gamaredon_dec2022","url":"https://unit42.paloaltonetworks.com/trident-ursa/"}]},{"technique_id":"T1608.001","description":"Gamaredon Group has registered domains to stage payloads.","sources":[{"source":"Microsoft Actinium February 2022","url":"https://www.microsoft.com/security/blog/2022/02/04/actinium-targets-ukrainian-organizations/"},{"source":"Unit 42 Gamaredon February 2022","url":"https://unit42.paloaltonetworks.com/gamaredon-primitive-bear-ukraine-update-2021/"}]},{"technique_id":"T1620","description":"Gamaredon Group has used an obfuscated PowerShell script that used System.Reflection.Assembly to gather and send victim information to the C2.","sources":[{"source":"SymantecCarbonBlack_ShuckwormUSB_Apr2025","url":"https://www.security.com/threat-intelligence/shuckworm-ukraine-gammasteel"}]},{"technique_id":"T1685","description":"Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.","sources":[{"source":"ESET Gamaredon June 2020","url":"https://www.welivesecurity.com/2020/06/11/gamaredon-group-grows-its-game/"},{"source":"ESET Gamaredon Sept2024","url":"https://web-assets.esetstatic.com/wls/en/papers/white-papers/cyberespionage-gamaredon-way.pdf"}]}]},{"id":"G0036","name":"GCMAN","procedures":[{"technique_id":"T1021.004","description":"GCMAN uses Putty for lateral movement.","sources":[{"source":"Securelist GCMAN","url":"https://securelist.com/apt-style-bank-robberies-increase-with-metel-gcman-and-carbanak-2-0-attacks/73638/"}]},{"technique_id":"T1021.005","description":"GCMAN uses VNC for lateral movement.","sources":[{"source":"Securelist GCMAN","url":"https://securelist.com/apt-style-bank-robberies-increase-with-metel-gcman-and-carbanak-2-0-attacks/73638/"}]}]},{"id":"G0115","name":"GOLD SOUTHFIELD","procedures":[{"technique_id":"T1027.010","description":"GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.","sources":[{"source":"Tetra Defense Sodinokibi March 2020","url":"https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"}]},{"technique_id":"T1059.001","description":"GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts.","sources":[{"source":"Tetra Defense Sodinokibi March 2020","url":"https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"}]},{"technique_id":"T1113","description":"GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.","sources":[{"source":"Tetra Defense Sodinokibi March 2020","url":"https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"}]},{"technique_id":"T1133","description":"GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.","sources":[{"source":"Secureworks REvil September 2019","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"technique_id":"T1190","description":"GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.","sources":[{"source":"Secureworks REvil September 2019","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"technique_id":"T1195.002","description":"GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.","sources":[{"source":"Secureworks REvil September 2019","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"},{"source":"Secureworks GandCrab and REvil September 2019","url":"https://www.secureworks.com/blog/revil-the-gandcrab-connection"},{"source":"Secureworks GOLD SOUTHFIELD","url":"https://www.secureworks.com/research/threat-profiles/gold-southfield"}]},{"technique_id":"T1199","description":"GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.","sources":[{"source":"Secureworks REvil September 2019","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]},{"technique_id":"T1219","description":"GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool \"ConnectWise Control\" to deploy REvil.","sources":[{"source":"Tetra Defense Sodinokibi March 2020","url":"https://web.archive.org/web/20210414101816/https://tetradefense.com/incident-response-services/cause-and-effect-sodinokibi-ransomware-analysis/"}]},{"technique_id":"T1566","description":"GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.","sources":[{"source":"Secureworks REvil September 2019","url":"https://www.secureworks.com/research/revil-sodinokibi-ransomware"}]}]},{"id":"G0078","name":"Gorgon Group","procedures":[{"technique_id":"T1055.002","description":"Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1055.012","description":"Gorgon Group malware can use process hollowing to inject one of its trojans into another process.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1059.001","description":"Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1059.003","description":"Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1059.005","description":"Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1105","description":"Gorgon Group malware can download additional files from C2 servers.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1106","description":"Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1112","description":"Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\\Software\\Microsoft\\Office\\.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1140","description":"Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1204.002","description":"Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1547.001","description":"Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1547.009","description":"Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1564.003","description":"Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1566.001","description":"Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1588.002","description":"Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]},{"technique_id":"T1685","description":"Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.","sources":[{"source":"Unit 42 Gorgon Group Aug 2018","url":"https://researchcenter.paloaltonetworks.com/2018/08/unit42-gorgon-group-slithering-nation-state-cybercrime/"}]}]},{"id":"G0043","name":"Group5","procedures":[{"technique_id":"T1027.013","description":"Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.","sources":[{"source":"Citizen Lab Group5","url":"https://citizenlab.ca/2016/08/group5-syria/"}]},{"technique_id":"T1056.001","description":"Malware used by Group5 is capable of capturing keystrokes.","sources":[{"source":"Citizen Lab Group5","url":"https://citizenlab.ca/2016/08/group5-syria/"}]},{"technique_id":"T1070.004","description":"Malware used by Group5 is capable of remotely deleting files from victims.","sources":[{"source":"Citizen Lab Group5","url":"https://citizenlab.ca/2016/08/group5-syria/"}]},{"technique_id":"T1113","description":"Malware used by Group5 is capable of watching the victim's screen.","sources":[{"source":"Citizen Lab Group5","url":"https://citizenlab.ca/2016/08/group5-syria/"}]}]},{"id":"G0125","name":"HAFNIUM","procedures":[{"technique_id":"T1003.001","description":"HAFNIUM has used procdump to dump the LSASS process memory.","sources":[{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"},{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1003.003","description":"HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).","sources":[{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1005","description":"HAFNIUM has collected data and files from a compromised machine.","sources":[{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"},{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1016","description":"HAFNIUM has collected IP information via IPInfo.","sources":[{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"technique_id":"T1016.001","description":"HAFNIUM has checked for network connectivity from a compromised host using ping, including attempts to contact google[.]com.","sources":[{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"technique_id":"T1018","description":"HAFNIUM has enumerated domain controllers using net group \"Domain computers\" and nltest /dclist.","sources":[{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"technique_id":"T1033","description":"HAFNIUM has used whoami to gather user information.","sources":[{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"technique_id":"T1057","description":"HAFNIUM has used tasklist to enumerate processes.","sources":[{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"technique_id":"T1059.001","description":"HAFNIUM has used the Exchange Power Shell module Set-OabVirtualDirectoryPowerShell to export mailbox data.","sources":[{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"},{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"}]},{"technique_id":"T1059.003","description":"HAFNIUM has used cmd.exe to execute commands on the victim's machine.","sources":[{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"technique_id":"T1068","description":"HAFNIUM has targeted unpatched applications to elevate access in targeted organizations.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1071.001","description":"HAFNIUM has used open-source C2 frameworks, including Covenant.","sources":[{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1078.003","description":"HAFNIUM has used the NT AUTHORITY\\SYSTEM account to create files on Exchange servers.","sources":[{"source":"FireEye Exchange Zero Days March 2021","url":"https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html"}]},{"technique_id":"T1078.004","description":"HAFNIUM has abused service principals in compromised environments to enable data exfiltration.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1083","description":"HAFNIUM has searched file contents on a compromised host.","sources":[{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"technique_id":"T1095","description":"HAFNIUM has used TCP for C2.","sources":[{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1098","description":"HAFNIUM has granted privileges to domain accounts and reset the password for default admin accounts.","sources":[{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1105","description":"HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.","sources":[{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"},{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1110.003","description":"HAFNIUM has gained initial access through password spray attacks.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1114.002","description":"HAFNIUM has used web shells and MSGraph to export mailbox data.","sources":[{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"},{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1119","description":"HAFNIUM has used MSGraph to exfiltrate data from email, OneDrive, and SharePoint.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1132.001","description":"HAFNIUM has used ASCII encoding for C2 traffic.","sources":[{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1136.002","description":"HAFNIUM has created domain accounts.","sources":[{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1190","description":"HAFNIUM has exploited multiple vulnerabilities to compromise edge devices and on-premises versions of Microsoft Exchange Server.","sources":[{"source":"FireEye Exchange Zero Days March 2021","url":"https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html"},{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"},{"source":"Tarrask scheduled task","url":"https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"},{"source":"Microsoft Log4j Vulnerability Exploitation December 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/"},{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1199","description":"HAFNIUM has used stolen API keys and credentials associated with privilege access management (PAM), cloud app providers, and cloud data management companies to access downstream customer environments.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1213.002","description":"HAFNIUM has abused compromised credentials to exfiltrate data from SharePoint.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1218.011","description":"HAFNIUM has used rundll32 to load malicious DLLs.","sources":[{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"}]},{"technique_id":"T1505.003","description":"HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.","sources":[{"source":"FireEye Exchange Zero Days March 2021","url":"https://www.fireeye.com/blog/threat-research/2021/03/detection-response-to-exploitation-of-microsoft-exchange-zero-day-vulnerabilities.html"},{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"},{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"},{"source":"Tarrask scheduled task","url":"https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/"},{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1530","description":"HAFNIUM has exfitrated data from OneDrive.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1550.001","description":"HAFNIUM has abused service principals with administrative permissions for data exfiltration.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1555.006","description":"HAFNIUM has moved laterally from on-premises environments to steal passwords from Azure key vaults.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1560.001","description":"HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.","sources":[{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"},{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"}]},{"technique_id":"T1564.001","description":"HAFNIUM has hidden files on a compromised host.","sources":[{"source":"Rapid7 HAFNIUM Mar 2021","url":"https://www.rapid7.com/blog/post/2021/03/23/defending-against-the-zero-day-analyzing-attacker-behavior-post-exploitation-of-microsoft-exchange/"}]},{"technique_id":"T1567.002","description":"HAFNIUM has exfiltrated data to file sharing sites, including MEGA.","sources":[{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1583.003","description":"HAFNIUM has operated from leased virtual private servers (VPS) in the United States.","sources":[{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1583.005","description":"HAFNIUM has incorporated leased devices into covert networks to obfuscate communications.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1583.006","description":"HAFNIUM has acquired web services for use in C2 and exfiltration.","sources":[{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1584.005","description":"HAFNIUM has used compromised devices in covert networks to obfuscate communications.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1589.002","description":"HAFNIUM has collected e-mail addresses for users they intended to target.","sources":[{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"}]},{"technique_id":"T1590","description":"HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.","sources":[{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"}]},{"technique_id":"T1590.005","description":"HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.","sources":[{"source":"Volexity Exchange Marauder March 2021","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"}]},{"technique_id":"T1592.004","description":"HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.","sources":[{"source":"Microsoft HAFNIUM March 2020","url":"https://www.microsoft.com/security/blog/2021/03/02/hafnium-targeting-exchange-servers/"}]},{"technique_id":"T1593.003","description":"HAFNIUM has discovered leaked corporate credentials on public repositories including GitHub.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"technique_id":"T1685.005","description":"HAFNIUM has cleared actor-performed actions from logs.","sources":[{"source":"Microsoft Silk Typhoon MAR 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]}]},{"id":"G1001","name":"HEXANE","procedures":[{"technique_id":"T1010","description":"HEXANE has used a PowerShell-based keylogging tool to capture the window title.","sources":[{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"technique_id":"T1016","description":"HEXANE has used Ping and tracert for network discovery.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1016.001","description":"HEXANE has used tools including BITSAdmin to test internet connectivity from compromised hosts.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1018","description":"HEXANE has used net view to enumerate domain machines.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1021.001","description":"HEXANE has used remote desktop sessions for lateral movement.","sources":[{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"technique_id":"T1027.010","description":"HEXANE has used Base64-encoded scripts.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1033","description":"HEXANE has run whoami on compromised machines to identify the current user.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1049","description":"HEXANE has used netstat to monitor connections to specific ports.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1053.005","description":"HEXANE has used a scheduled task to establish persistence for a keylogger.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1056.001","description":"HEXANE has used a PowerShell-based keylogger named kl.ps1.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"},{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"technique_id":"T1057","description":"HEXANE has enumerated processes on targeted systems.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1059.001","description":"HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.","sources":[{"source":"Kaspersky APT Trends Q1 April 2021","url":"https://securelist.com/apt-trends-report-q1-2021/101967"},{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"},{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"technique_id":"T1059.005","description":"HEXANE has used a VisualBasic script named MicrosoftUpdator.vbs for execution of a PowerShell keylogger.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1069.001","description":"HEXANE has run net localgroup to enumerate local groups.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1082","description":"HEXANE has collected the hostname of a compromised machine.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1102.002","description":"HEXANE has used cloud services, including OneDrive, for C2.","sources":[{"source":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"technique_id":"T1105","description":"HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1110","description":"HEXANE has used brute force attacks to compromise valid credentials.","sources":[{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"technique_id":"T1110.003","description":"HEXANE has used password spraying attacks to obtain valid credentials.","sources":[{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"technique_id":"T1204.002","description":"HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.","sources":[{"source":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"},{"source":"Dragos Hexane","url":"https://dragos.com/resource/hexane/"},{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"},{"source":"Zscaler Lyceum DnsSystem June 2022","url":"https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"}]},{"technique_id":"T1518","description":"HEXANE has enumerated programs installed on an infected machine.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1534","description":"HEXANE has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.","sources":[{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"technique_id":"T1546.003","description":"HEXANE has used WMI event subscriptions for persistence.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1555","description":"HEXANE has run cmdkey on victim machines to identify stored credentials.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1555.003","description":"HEXANE has used a Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1567.002","description":"HEXANE has used cloud services, including OneDrive, for data exfiltration.","sources":[{"source":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"technique_id":"T1583.001","description":"HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.","sources":[{"source":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"},{"source":"Dragos Hexane","url":"https://dragos.com/resource/hexane/"},{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"technique_id":"T1583.002","description":"HEXANE has set up custom DNS servers to send commands to compromised hosts via TXT records.","sources":[{"source":"Zscaler Lyceum DnsSystem June 2022","url":"https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"}]},{"technique_id":"T1585.001","description":"HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.","sources":[{"source":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}]},{"technique_id":"T1585.002","description":"HEXANE has established email accounts for use in domain registration including for ProtonMail addresses.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"}]},{"technique_id":"T1586.002","description":"HEXANE has used compromised accounts to send spearphishing emails.","sources":[{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"technique_id":"T1588.002","description":"HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.","sources":[{"source":"Kaspersky Lyceum October 2021","url":"https://vblocalhost.com/uploads/VB2021-Kayal-etal.pdf"},{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"},{"source":"Zscaler Lyceum DnsSystem June 2022","url":"https://www.zscaler.com/blogs/security-research/lyceum-net-dns-backdoor"}]},{"technique_id":"T1589","description":"HEXANE has identified specific potential victims at targeted organizations.","sources":[{"source":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}]},{"technique_id":"T1589.002","description":"HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.","sources":[{"source":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"},{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"technique_id":"T1591.004","description":"HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.","sources":[{"source":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"},{"source":"SecureWorks August 2019","url":"https://www.secureworks.com/blog/lyceum-takes-center-stage-in-middle-east-campaign"}]},{"technique_id":"T1608.001","description":"HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.","sources":[{"source":"ClearSky Siamesekitten August 2021","url":"https://www.clearskysec.com/siamesekitten/"}]}]},{"id":"G0126","name":"Higaisa","procedures":[{"technique_id":"T1001.003","description":"Higaisa used a FakeTLS session for C2 communications.","sources":[{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1016","description":"Higaisa used ipconfig to gather network configuration information.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1027.001","description":"Higaisa performed padding with null bytes before calculating its hash.","sources":[{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1027.013","description":"Higaisa used Base64 encoded compressed payloads.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1027.015","description":"Higaisa used Base64 encoded compressed payloads.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1029","description":"Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.","sources":[{"source":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]},{"technique_id":"T1036.004","description":"Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1041","description":"Higaisa exfiltrated data over its C2 channel.","sources":[{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1053.005","description":"Higaisa dropped and added officeupdate.exe to scheduled tasks.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1057","description":"Higaisa’s shellcode attempted to find the process ID of the current process.","sources":[{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1059.003","description":"Higaisa used cmd.exe for execution.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"},{"source":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]},{"technique_id":"T1059.005","description":"Higaisa has used VBScript code on the victim's machine.","sources":[{"source":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]},{"technique_id":"T1059.007","description":"Higaisa used JavaScript to execute additional files.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"},{"source":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]},{"technique_id":"T1071.001","description":"Higaisa used HTTP and HTTPS to send data back to its C2 server.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1082","description":"Higaisa collected the system GUID and computer name.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]},{"technique_id":"T1090.001","description":"Higaisa discovered system proxy settings and used them if available.","sources":[{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1106","description":"Higaisa has called various native OS APIs.","sources":[{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1124","description":"Higaisa used a function to gather the current time.","sources":[{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1140","description":"Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1203","description":"Higaisa has exploited CVE-2018-0798 for execution.","sources":[{"source":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]},{"technique_id":"T1204.002","description":"Higaisa used malicious e-mail attachments to lure victims into executing LNK files.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1220","description":"Higaisa used an XSL file to run VBScript code.","sources":[{"source":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]},{"technique_id":"T1547.001","description":"Higaisa added a spoofed binary to the start-up folder for persistence.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1564.003","description":"Higaisa used a payload that creates a hidden window.","sources":[{"source":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]},{"technique_id":"T1566.001","description":"Higaisa has sent spearphishing emails containing malicious attachments.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1573.001","description":"Higaisa used AES-128 to encrypt C2 traffic.","sources":[{"source":"Zscaler Higaisa 2020","url":"https://www.zscaler.com/blogs/security-research/return-higaisa-apt"}]},{"technique_id":"T1574.001","description":"Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library.","sources":[{"source":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]},{"technique_id":"T1680","description":"Higaisa collected the system volume serial number.","sources":[{"source":"Malwarebytes Higaisa 2020","url":"https://blog.malwarebytes.com/threat-analysis/2020/06/higaisa/"},{"source":"PTSecurity Higaisa 2020","url":"https://www.ptsecurity.com/ww-en/analytics/pt-esc-threat-intelligence/covid-19-and-new-year-greetings-the-higaisa-group/"}]}]},{"id":"G1032","name":"INC Ransom","procedures":[{"technique_id":"T1021.001","description":"INC Ransom has used RDP to move laterally.","sources":[{"source":"Huntress INC Ransomware May 2024","url":"https://www.huntress.com/blog/lolbin-to-inc-ransomware"},{"source":"Cybereason INC Ransomware November 2023","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"},{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1036.005","description":"INC Ransom has named a PsExec executable winupd to mimic a legitimate Windows update file.","sources":[{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1046","description":"INC Ransom has used NETSCAN.EXE for internal reconnaissance.","sources":[{"source":"SentinelOne INC Ransomware","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"}]},{"technique_id":"T1047","description":"INC Ransom has used WMIC to deploy ransomware.","sources":[{"source":"Cybereason INC Ransomware November 2023","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"},{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1049","description":"INC Ransom has used RDP to test network connections.","sources":[{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"}]},{"technique_id":"T1059.003","description":"INC Ransom has used cmd.exe to launch malicious payloads.","sources":[{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1069.002","description":"INC Ransom has enumerated domain groups on targeted hosts.","sources":[{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1070.004","description":"INC Ransom has uninstalled tools from compromised endpoints after use.","sources":[{"source":"Huntress INC Ransomware May 2024","url":"https://www.huntress.com/blog/lolbin-to-inc-ransomware"}]},{"technique_id":"T1071","description":"INC Ransom has used valid accounts over RDP to connect to targeted systems.","sources":[{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1074","description":"INC Ransom has staged data on compromised hosts prior to exfiltration.","sources":[{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1078","description":"INC Ransom has used compromised valid accounts for access to victim environments.","sources":[{"source":"Huntress INC Ransomware May 2024","url":"https://www.huntress.com/blog/lolbin-to-inc-ransomware"},{"source":"Cybereason INC Ransomware November 2023","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"},{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1087.002","description":"INC Ransom has scanned for domain admin accounts in compromised environments.","sources":[{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"}]},{"technique_id":"T1105","description":"INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner.","sources":[{"source":"Huntress INC Ransomware May 2024","url":"https://www.huntress.com/blog/lolbin-to-inc-ransomware"},{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1135","description":"INC Ransom has used Internet Explorer to view folders on other systems.","sources":[{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1190","description":"INC Ransom has exploited known vulnerabilities including CVE-2023-3519 in Citrix NetScaler for initial access.","sources":[{"source":"SentinelOne INC Ransomware","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"}]},{"technique_id":"T1219","description":"INC Ransom has used AnyDesk and PuTTY on compromised systems.","sources":[{"source":"Huntress INC Ransomware May 2024","url":"https://www.huntress.com/blog/lolbin-to-inc-ransomware"},{"source":"SentinelOne INC Ransomware","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1486","description":"INC Ransom has used INC Ransomware to encrypt victim's data.","sources":[{"source":"Secureworks GOLD IONIC April 2024","url":"https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"},{"source":"Cybereason INC Ransomware November 2023","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"},{"source":"SentinelOne INC Ransomware","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"},{"source":"Bleeping Computer INC Ransomware March 2024","url":"https://www.bleepingcomputer.com/news/security/inc-ransom-threatens-to-leak-3tb-of-nhs-scotland-stolen-data/"}]},{"technique_id":"T1537","description":"INC Ransom has used Megasync to exfiltrate data to the cloud.","sources":[{"source":"Secureworks GOLD IONIC April 2024","url":"https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"}]},{"technique_id":"T1560.001","description":"INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.","sources":[{"source":"Huntress INC Ransomware May 2024","url":"https://www.huntress.com/blog/lolbin-to-inc-ransomware"},{"source":"Secureworks GOLD IONIC April 2024","url":"https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"},{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1566","description":"INC Ransom has used phishing to gain initial access.","sources":[{"source":"SentinelOne INC Ransomware","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"}]},{"technique_id":"T1569.002","description":"INC Ransom has run a file encryption executable via Service Control Manager/7045;winupd,%SystemRoot%\\winupd.exe,user mode service,demand start,LocalSystem.","sources":[{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1570","description":"INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.","sources":[{"source":"Secureworks GOLD IONIC April 2024","url":"https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"},{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1588.002","description":"INC Ransom has acquired and used several tools including MegaSync, AnyDesk, esentutl and PsExec.","sources":[{"source":"Huntress INC Ransomware May 2024","url":"https://www.huntress.com/blog/lolbin-to-inc-ransomware"},{"source":"Cybereason INC Ransomware November 2023","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"},{"source":"SentinelOne INC Ransomware","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source":"Huntress INC Ransom Group August 2023","url":"https://www.huntress.com/blog/investigating-new-inc-ransom-group-activity"}]},{"technique_id":"T1657","description":"INC Ransom has stolen and encrypted victim's data in order to extort payment for keeping it private or decrypting it.","sources":[{"source":"Secureworks GOLD IONIC April 2024","url":"https://www.secureworks.com/blog/gold-ionic-deploys-inc-ransomware"},{"source":"Cybereason INC Ransomware November 2023","url":"https://web.archive.org/web/20231202022946/https://www.cybereason.com/hubfs/dam/collateral/reports/threat-alert-inc-ransomware.pdf"},{"source":"SentinelOne INC Ransomware","url":"https://www.sentinelone.com/anthology/inc-ransom/"},{"source":"SOCRadar INC Ransom January 2024","url":"https://socradar.io/dark-web-profile-inc-ransom/"},{"source":"Bleeping Computer INC Ransomware March 2024","url":"https://www.bleepingcomputer.com/news/security/inc-ransom-threatens-to-leak-3tb-of-nhs-scotland-stolen-data/"}]},{"technique_id":"T1685","description":"INC Ransom can use SystemSettingsAdminFlows.exe, a native Windows utility, to disable Windows Defender.","sources":[{"source":"Huntress INC Ransomware May 2024","url":"https://www.huntress.com/blog/lolbin-to-inc-ransomware"}]}]},{"id":"G0100","name":"Inception","procedures":[{"technique_id":"T1005","description":"Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.","sources":[{"source":"Kaspersky Cloud Atlas August 2019","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"}]},{"technique_id":"T1027.013","description":"Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.","sources":[{"source":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"}]},{"technique_id":"T1057","description":"Inception has used a reconnaissance module to identify active processes and other associated loaded modules.","sources":[{"source":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}]},{"technique_id":"T1059.001","description":"Inception has used PowerShell to execute malicious commands and payloads.","sources":[{"source":"Unit 42 Inception November 2018","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"},{"source":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"}]},{"technique_id":"T1059.005","description":"Inception has used VBScript to execute malicious commands and payloads.","sources":[{"source":"Unit 42 Inception November 2018","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"},{"source":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"}]},{"technique_id":"T1069.002","description":"Inception has used specific malware modules to gather domain membership.","sources":[{"source":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}]},{"technique_id":"T1071.001","description":"Inception has used HTTP, HTTPS, and WebDav in network communications.","sources":[{"source":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"},{"source":"Unit 42 Inception November 2018","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"}]},{"technique_id":"T1082","description":"Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.","sources":[{"source":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}]},{"technique_id":"T1083","description":"Inception used a file listing plugin to collect information about file and directories both on local and remote drives.","sources":[{"source":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}]},{"technique_id":"T1090.003","description":"Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.","sources":[{"source":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}]},{"technique_id":"T1102","description":"Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.","sources":[{"source":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"},{"source":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}]},{"technique_id":"T1203","description":"Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.","sources":[{"source":"Kaspersky Cloud Atlas August 2019","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"},{"source":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"},{"source":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"},{"source":"Unit 42 Inception November 2018","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"}]},{"technique_id":"T1204.002","description":"Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.","sources":[{"source":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"},{"source":"Kaspersky Cloud Atlas August 2019","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"},{"source":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"},{"source":"Unit 42 Inception November 2018","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"}]},{"technique_id":"T1218.005","description":"Inception has used malicious HTA files to drop and execute malware.","sources":[{"source":"Kaspersky Cloud Atlas August 2019","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"}]},{"technique_id":"T1218.010","description":"Inception has ensured persistence at system boot by setting the value regsvr32 %path%\\ctfmonrn.dll /s.","sources":[{"source":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"}]},{"technique_id":"T1221","description":"Inception has used decoy documents to load malicious remote payloads via HTTP.","sources":[{"source":"Unit 42 Inception November 2018","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"}]},{"technique_id":"T1518","description":"Inception has enumerated installed software on compromised systems.","sources":[{"source":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}]},{"technique_id":"T1547.001","description":"Inception has maintained persistence by modifying Registry run key value HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\.","sources":[{"source":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"}]},{"technique_id":"T1555.003","description":"Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.","sources":[{"source":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"}]},{"technique_id":"T1566.001","description":"Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.","sources":[{"source":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"},{"source":"Symantec Inception Framework March 2018","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/inception-framework-hiding-behind-proxies"},{"source":"Unit 42 Inception November 2018","url":"https://unit42.paloaltonetworks.com/unit42-inception-attackers-target-europe-year-old-office-vulnerability/"},{"source":"Kaspersky Cloud Atlas August 2019","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"}]},{"technique_id":"T1573.001","description":"Inception has encrypted network communications with AES.","sources":[{"source":"Kaspersky Cloud Atlas December 2014","url":"https://securelist.com/cloud-atlas-redoctober-apt-is-back-in-style/68083/"}]},{"technique_id":"T1588.002","description":"Inception has obtained and used open-source tools such as LaZagne.","sources":[{"source":"Kaspersky Cloud Atlas August 2019","url":"https://securelist.com/recent-cloud-atlas-activity/92016/"}]}]},{"id":"G0136","name":"IndigoZebra","procedures":[{"technique_id":"T1105","description":"IndigoZebra has downloaded additional files and tools from its C2 server.","sources":[{"source":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]},{"technique_id":"T1204.002","description":"IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.","sources":[{"source":"HackerNews IndigoZebra July 2021","url":"https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html"}]},{"technique_id":"T1566.001","description":"IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.","sources":[{"source":"HackerNews IndigoZebra July 2021","url":"https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html"},{"source":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]},{"technique_id":"T1583.001","description":"IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.","sources":[{"source":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]},{"technique_id":"T1583.006","description":"IndigoZebra created Dropbox accounts for their operations.","sources":[{"source":"HackerNews IndigoZebra July 2021","url":"https://thehackernews.com/2021/07/indigozebra-apt-hacking-campaign.html"},{"source":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]},{"technique_id":"T1586.002","description":"IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.","sources":[{"source":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"}]},{"technique_id":"T1588.002","description":"IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.","sources":[{"source":"Checkpoint IndigoZebra July 2021","url":"https://research.checkpoint.com/2021/indigozebra-apt-continues-to-attack-central-asia-with-evolving-tools/"},{"source":"Securelist APT Trends Q2 2017","url":"https://securelist.com/apt-trends-report-q2-2017/79332/"}]}]},{"id":"G0119","name":"Indrik Spider","procedures":[{"technique_id":"T1003.001","description":"Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.","sources":[{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1007","description":"Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.","sources":[{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1012","description":"Indrik Spider has used a service account to extract copies of the Security Registry hive.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1018","description":"Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.","sources":[{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1021.001","description":"Indrik Spider has used RDP for lateral movement.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1021.004","description":"Indrik Spider has used SSH for lateral movement.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1036.005","description":"Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.","sources":[{"source":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"technique_id":"T1047","description":"Indrik Spider has used WMIC to execute commands on remote computers.","sources":[{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1059.001","description":"Indrik Spider has used PowerShell Empire for execution of malware.","sources":[{"source":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"},{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1059.003","description":"Indrik Spider has used batch scripts on victim's machines.","sources":[{"source":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"},{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1059.007","description":"Indrik Spider has used malicious JavaScript files for several components of their attack.","sources":[{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1074.001","description":"Indrik Spider has stored collected data in a .tmp file.","sources":[{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1078","description":"Indrik Spider has used valid accounts for initial access and lateral movement. Indrik Spider has also maintained access to the victim environment through the VPN infrastructure.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1078.002","description":"Indrik Spider has collected credentials from infected systems, including domain accounts.","sources":[{"source":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"technique_id":"T1105","description":"Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.","sources":[{"source":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"},{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"},{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1112","description":"Indrik Spider has modified registry keys to prepare for ransomware execution and to disable common administrative utilities.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1136","description":"Indrik Spider used wmic.exe to add a new user to the system.","sources":[{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1136.001","description":"Indrik Spider has created local system accounts and has added the accounts to privileged groups.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1204.002","description":"Indrik Spider has attempted to get users to click on a malicious zipped file.","sources":[{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1484.001","description":"Indrik Spider has used Group Policy Objects to deploy batch scripts.","sources":[{"source":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"},{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1486","description":"Indrik Spider has encrypted domain-controlled systems using BitPaymer. Additionally, Indrik Spider used PsExec to execute a ransomware script.","sources":[{"source":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"},{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1489","description":"Indrik Spider has used PsExec to stop services prior to the execution of ransomware.","sources":[{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1552.001","description":"Indrik Spider has searched files to obtain and exfiltrate credentials.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1555.005","description":"Indrik Spider has accessed and exported passwords from password managers.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1558.003","description":"Indrik Spider has conducted Kerberoasting attacks using a module from GitHub.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1567.002","description":"Indrik Spider has exfiltrated data using Rclone or MEGASync prior to deploying ransomware.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1583","description":"Indrik Spider has purchased access to victim VPNs to facilitate access to victim environments.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1584.004","description":"Indrik Spider has served fake updates via legitimate websites that have been compromised.","sources":[{"source":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"technique_id":"T1585.002","description":"Indrik Spider has created email accounts to communicate with their ransomware victims, to include providing payment and decryption details.","sources":[{"source":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"technique_id":"T1587.001","description":"Indrik Spider has developed malware for their operations, including ransomware such as BitPaymer and WastedLocker.","sources":[{"source":"Crowdstrike Indrik November 2018","url":"https://www.crowdstrike.com/blog/big-game-hunting-the-evolution-of-indrik-spider-from-dridex-wire-fraud-to-bitpaymer-targeted-ransomware/"}]},{"technique_id":"T1590","description":"Indrik Spider has downloaded tools, such as the Advanced Port Scanner utility and Lansweeper, to conduct internal reconnaissance of the victim network. Indrik Spider has also accessed the victim’s VMware VCenter, which had information about host configuration, clusters, etc.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"}]},{"technique_id":"T1685","description":"Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring. Indrik Spider has used MpCmdRun to revert the definitions in Microsoft Defender. Additionally, Indrik Spider has used WMI to stop or uninstall and reset anti-virus products and other defensive services.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"},{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]},{"technique_id":"T1685.005","description":"Indrik Spider has used Cobalt Strike to empty log files. Additionally, Indrik Spider has cleared all event logs using wevutil.","sources":[{"source":"Mandiant_UNC2165","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc2165-shifts-to-evade-sanctions/"},{"source":"Symantec WastedLocker June 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/wastedlocker-ransomware-us"}]}]},{"id":"G0004","name":"Ke3chang","procedures":[{"technique_id":"T1003.001","description":"Ke3chang has dumped credentials, including by using Mimikatz.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"},{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"},{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}]},{"technique_id":"T1003.002","description":"Ke3chang has dumped credentials, including by using gsecdump.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1003.003","description":"Ke3chang has used NTDSDump and other password dumping tools to gather credentials.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1003.004","description":"Ke3chang has dumped credentials, including by using gsecdump.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1005","description":"Ke3chang gathered information and files from local directories for exfiltration.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1007","description":"Ke3chang performs service discovery using net start commands.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}]},{"technique_id":"T1016","description":"Ke3chang has performed local network configuration discovery using ipconfig.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"},{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1018","description":"Ke3chang has used network scanning and enumeration tools, including Ping.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1020","description":"Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1021.002","description":"Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1027","description":"Ke3chang has used Base64-encoded shellcode strings.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1033","description":"Ke3chang has used implants capable of collecting the signed-in username.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1036.002","description":"Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}]},{"technique_id":"T1036.005","description":"Ke3chang has dropped their malware into legitimate installed software paths including: C:\\ProgramFiles\\Realtek\\Audio\\HDA\\AERTSr.exe, C:\\Program Files (x86)\\Foxit Software\\Foxit Reader\\FoxitRdr64.exe, C:\\Program Files (x86)\\Adobe\\Flash Player\\AddIns\\airappinstaller\\airappinstall.exe, and C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\AcroRd64.exe.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1041","description":"Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}]},{"technique_id":"T1049","description":"Ke3chang performs local network connection discovery using netstat.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1056.001","description":"Ke3chang has used keyloggers.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"},{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1057","description":"Ke3chang performs process discovery using tasklist commands.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1059","description":"Malware used by Ke3chang can run commands on the command-line interface.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1059.003","description":"Ke3chang has used batch scripts in its malware to install persistence mechanisms.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1069.002","description":"Ke3chang performs discovery of permission groups net group /domain.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}]},{"technique_id":"T1071.001","description":"Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"},{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1071.004","description":"Ke3chang malware RoyalDNS has used DNS for C2.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1078","description":"Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1078.004","description":"Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1082","description":"Ke3chang performs operating system information discovery using systeminfo and has used implants to identify the system language and computer name.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"},{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1083","description":"Ke3chang uses command-line interaction to search files and directories.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1087.001","description":"Ke3chang performs account discovery using commands such as net localgroup administrators and net group \"REDACTED\" /domain on specific permissions groups.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}]},{"technique_id":"T1087.002","description":"Ke3chang performs account discovery using commands such as net localgroup administrators and net group \"REDACTED\" /domain on specific permissions groups.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}]},{"technique_id":"T1105","description":"Ke3chang has used tools to download files to compromised machines.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1114.002","description":"Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"},{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1119","description":"Ke3chang has performed frequent and scheduled data collection from victim networks.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1133","description":"Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"},{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1140","description":"Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1190","description":"Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1213.002","description":"Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1543.003","description":"Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1547.001","description":"Several Ke3chang backdoors achieved persistence by adding a Run key.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1558.001","description":"Ke3chang has used Mimikatz to generate Kerberos golden tickets.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1560","description":"The Ke3chang group has been known to compress data before exfiltration.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"}]},{"technique_id":"T1560.001","description":"Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.","sources":[{"source":"Mandiant Operation Ke3chang November 2014","url":"https://www.mandiant.com/resources/operation-ke3chang-targeted-attacks-against-ministries-of-foreign-affairs"},{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1569.002","description":"Ke3chang has used a tool known as RemoteExec (similar to PsExec) to remotely execute batch scripts and binaries.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1583.005","description":"Ke3chang has utilized an ORB (operational relay box) network for reconnaissance and vulnerability exploitation.","sources":[{"source":"ORB Mandiant","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"}]},{"technique_id":"T1587.001","description":"Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]},{"technique_id":"T1588.002","description":"Ke3chang has obtained and used tools such as Mimikatz.","sources":[{"source":"NCC Group APT15 Alive and Strong","url":"https://research.nccgroup.com/2018/03/10/apt15-is-alive-and-strong-an-analysis-of-royalcli-and-royaldns/"}]},{"technique_id":"T1614.001","description":"Ke3chang has used implants to collect the system language ID of a compromised machine.","sources":[{"source":"Microsoft NICKEL December 2021","url":"https://www.microsoft.com/security/blog/2021/12/06/nickel-targeting-government-organizations-across-latin-america-and-europe"}]}]},{"id":"G0094","name":"Kimsuky","procedures":[{"technique_id":"T1003.001","description":"Kimsuky has gathered credentials using Mimikatz and ProcDump.","sources":[{"source":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"},{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1005","description":"Kimsuky has collected Office, PDF, and HWP documents from its victims. Kimsuky has also harvested victim files through the use of the RecentFiles() function that collects paths of recently accessed files by parsing .lnk shortcuts from %APPDATA%\\Microsoft\\Windows\\Recent.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1007","description":"Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"}]},{"technique_id":"T1012","description":"Kimsuky has obtained specific Registry keys and values on a compromised host.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"}]},{"technique_id":"T1016","description":"Kimsuky has used ipconfig/all and web beacons sent via email to gather network configuration information. Kimsuky has also identified Host IP addresses leveraging the WMI class Win32_NetworkAdapterConfiguration.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"Proofpoint TA427 April 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering"}]},{"technique_id":"T1020","description":"Kimsuky has exfiltrated data to C2 servers using an automated script that executes every 10 minutes and after successful checks for the presence of pre-designated staged filenames.","sources":[{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1021.001","description":"Kimsuky has used RDP for direct remote point-and-click access.","sources":[{"source":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"}]},{"technique_id":"T1027","description":"Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding. Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format. Kimsuky has obfuscated strings using Single Instruction Multiple Data (SIMD) instructions that complicate static analysis.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"VirusBulletin Kimsuky October 2019","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"},{"source":"ThreatConnect Kimsuky September 2020","url":"https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"}]},{"technique_id":"T1027.001","description":"Kimsuky has performed padding of PowerShell command line code with over 100 spaces.","sources":[{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"}]},{"technique_id":"T1027.002","description":"Kimsuky has packed malware with UPX.","sources":[{"source":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"technique_id":"T1027.007","description":"Kimsuky has leveraged dynamic API resolution using custom hashing techniques.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"}]},{"technique_id":"T1027.010","description":"Kimsuky has encoded malicious PowerShell scripts using Base64.","sources":[{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"}]},{"technique_id":"T1027.012","description":"Kimsuky has used the LNK icon location to execute malicious scripts. Kimsuky has also padded the LNK target field properties with extra spaces to obscure the script.","sources":[{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1027.013","description":"Kimsuky has obfuscated code within files by converting hexadecimal strings to decimal numbers using the CLng function in combination with processing arithmetic operations and leveraging the Chr function to generate readable characters. Kimsuky has also encoded files with Base64 and RC4. Kimsuky has utilized XOR and RC4 to encode malicious payloads.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1027.015","description":"Kimsuky has delivered malicious payloads within Zip archives.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"}]},{"technique_id":"T1027.016","description":"Kimsuky has obfuscated code by filling scripts with junk code and concatenating strings to hamper analysis and detection.","sources":[{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"}]},{"technique_id":"T1033","description":"Kimsuky has gathered the identity of the user by querying System.Security.Principal namespace using the GetCurrent() method.","sources":[{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1036.004","description":"Kimsuky has disguised services to appear as benign software or related to operating system functions.","sources":[{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"}]},{"technique_id":"T1036.005","description":"Kimsuky has renamed malware to legitimate names such as ESTCommon.dll or patch.dll. Kimsuky has also disguised payloads using legitimate file names including a PowerShell payload named chrome.ps1. Kimsuky has also used a malicious QR code that masqueraded as a legitimate package delivery service.","sources":[{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"EnkiWhiteHat_KimsukyDOCSWAP_Dec2025","url":"https://www.enki.co.kr/en/media-center/blog/kimsuky-distributing-malicious-mobile-app-via-qr-code"},{"source":"Kimsuky Malwarebytes","url":"https://www.malwarebytes.com/blog/threat-intelligence/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor"}]},{"technique_id":"T1036.007","description":"Kimsuky has used an additional filename extension to hide the true file type. Kimsuky has also masqueraded malicious LNK files as PDF objects using the double extension .pdf.lnk.","sources":[{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"}]},{"technique_id":"T1040","description":"Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.","sources":[{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"}]},{"technique_id":"T1041","description":"Kimsuky has exfiltrated data over its C2 channel.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}]},{"technique_id":"T1053.005","description":"Kimsuky has downloaded additional malware with scheduled tasks. Kimsuky has established persistence by creating a scheduled task named “ChromeUpdateTaskMachine” through the PowerShell cmdlet Register-ScheduleTask which was set to execute another PowerShell script once, then five minutes after its creation and periodically repeat every 30 minutes. Kimsuky has also set scheduled tasks that run periodically using the PT1M repetition pattern leveraging naming conventions of Anti-Virus software to include \"AhnlabUpdate\".","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}]},{"technique_id":"T1055","description":"Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.","sources":[{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}]},{"technique_id":"T1055.001","description":"Kimsuky has the ability to load DLLs via reflective injection by allocating memory using VirtualAllocEx(), then decrypting a DLL with WriteProcessMemory() and invoking execution through CreateRemoteThread().","sources":[{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1055.012","description":"Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"}]},{"technique_id":"T1056.001","description":"Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes. Kimsuky has also leveraged Native Windows API functions such as GetAsyncKeyState() along with others to capture keystrokes every 50 milliseconds and stores data in a file stored in the temp directory.","sources":[{"source":"EST Kimsuky April 2019","url":"https://blog.alyac.co.kr/2234"},{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"},{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1056.003","description":"Kimsuky has collected credentials from a fake Google account login page.","sources":[{"source":"FBI_KimsukyQR_Jan2026","url":"https://www.ic3.gov/CSA/2026/260108.pdf"}]},{"technique_id":"T1057","description":"Kimsuky can gather a list of all processes running on a victim's machine. Kimsuky has also obtained running processes on the victim device utilizing PowerShell cmdlet Get-Process.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"}]},{"technique_id":"T1059.001","description":"Kimsuky has executed a variety of PowerShell scripts including Invoke-Mimikatz. Kimsuky has also utilized PowerShell scripts for execution, persistence, and defense evasion. Kimsuky has leveraged PowerShell’s cmdlet Expand-Archive to extract contents of zip files into the same directory. Kimsuky has employed ClickFix type tactics enticing victims to copy and paste malicious PowerShell commands and scripts, where the scripts ultimately led to QuasarRAT.","sources":[{"source":"EST Kimsuky April 2019","url":"https://blog.alyac.co.kr/2234"},{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1059.003","description":"Kimsuky has executed Windows commands by using cmd and running batch scripts. Kimsuky has also used cmd.exe to automatically open downloaded decoy pdf documents with the system’s default PDF viewer. Kimsuky has utilized malicious payloads to create reverse shells within the victim environment. Kimsuky has also used batch scripts to eventually run QuasarRAT.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1059.005","description":"Kimsuky has used Visual Basic to download malicious payloads. Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure. Kimsuky has also leveraged VBScript (VBS) scripts to execute temp.vbs every 19 minutes using a scheduled task to run QuasarRAT.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"VirusBulletin Kimsuky October 2019","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"},{"source":"ThreatConnect Kimsuky September 2020","url":"https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1059.006","description":"Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.","sources":[{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1059.007","description":"Kimsuky has used JScript for logging and downloading additional tools. Kimsuky has used TRANSLATEXT, which contained four Javascript files for bypassing defenses, collecting sensitive information and screenshots, and exfiltrating data.","sources":[{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"VirusBulletin Kimsuky October 2019","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"},{"source":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"technique_id":"T1070.004","description":"Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk. Kimsuky has deleted files using the Remove-Item PowerShell commandlet to remove traces of executed payloads. Kimsuky has also removed remnants of files used for delivery to include .log and .zip files.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1070.006","description":"Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.","sources":[{"source":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"}]},{"technique_id":"T1071.001","description":"Kimsuky has used HTTP GET and POST requests for C2.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1071.002","description":"Kimsuky has used FTP to download additional malware to the target machine.","sources":[{"source":"VirusBulletin Kimsuky October 2019","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"}]},{"technique_id":"T1071.003","description":"Kimsuky has used e-mail to send exfiltrated data to C2 servers.","sources":[{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"}]},{"technique_id":"T1074.001","description":"Kimsuky has staged collected data files under C:\\Program Files\\Common Files\\System\\Ole DB\\. Kimsuky has also gathered data in structured directories prior to exfiltration under the %TEMP% environment variable.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1078.003","description":"Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.","sources":[{"source":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"}]},{"technique_id":"T1082","description":"Kimsuky has enumerated OS type, OS version, and other information using a script or the \"systeminfo\" command. Kimsuky has also obtained system information such as OS type, OS version, and system type through querying various Windows Management Instrumentation (WMI) classes including Win32_OperatingSystem.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1083","description":"Kimsuky has the ability to enumerate all files and directories on an infected system. Kimsuky has used a custom script with a function called CreateFileList() that can scan all filesystem drives, prioritizing C:\\Users, to locate files and file extensions of interest that ultimately generates a file called FileList.txt saved within the victims %TEMP% Directory that contains the findings and the respective pathways.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1098.007","description":"Kimsuky has added accounts to specific groups with net localgroup.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1102.001","description":"Kimsuky has used TRANSLATEXT and a dead drop resolver to retrieve configurations and commands from a public blog site.","sources":[{"source":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"technique_id":"T1102.002","description":"Kimsuky has used Blogspot pages and a Github repository for C2. Kimsuky has also leveraged Dropbox for downloading payloads and uploading victim system information.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"technique_id":"T1105","description":"Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1106","description":"Kimsuky has utilized Native APIs to collect data from victim hosts and facilitate execution of malicious scripts.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1111","description":"Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1112","description":"Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence. Kimsuky has also modified the registry entry for HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Run registry key for persistence with the name WindowsSecurityCheck.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1113","description":"Kimsuky has captured browser screenshots using TRANSLATEXT. Kimsuky has also obtained screen captures with custom malware.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"technique_id":"T1114.002","description":"Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1114.003","description":"Kimsuky has set auto-forward rules on victim's e-mail accounts.","sources":[{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"}]},{"technique_id":"T1115","description":"Kimsuky has the ability to steal data from the clipboard.","sources":[{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1124","description":"Kimsuky has gathered the system time of the device using the PowerShell cmdlet Get-Date.","sources":[{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1132.002","description":"Kimsuky has obfuscated HTTP Post request communications utilizing XOR with a designated key, followed by Base64 encoding.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"}]},{"technique_id":"T1133","description":"Kimsuky has used RDP to establish persistence.","sources":[{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"}]},{"technique_id":"T1136.001","description":"Kimsuky has created accounts with net user.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1140","description":"Kimsuky has decoded malicious VBScripts using Base64. Kimsuky has also decoded malicious PowerShell scripts using Base64. Kimsuky has decoded RC4 obfuscated files prior to downloading files from their infrastructure.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1176.001","description":"Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.","sources":[{"source":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"},{"source":"Zdnet Kimsuky Dec 2018","url":"https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/"}]},{"technique_id":"T1185","description":"Kimsuky has the ability to use form-grabbing to extract emails and passwords from web data forms.","sources":[{"source":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"technique_id":"T1190","description":"Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1204.001","description":"Kimsuky has lured victims into clicking malicious links.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1204.002","description":"Kimsuky has used spearphishing attachments to entice victims into opening malicious files, including LNK files disguised with tailored filenames and fake extensions. Kimsuky has also delivered malicious payloads within archive files (e.g., ZIP), which display decoy documents upon execution while running malicious code in the background.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"},{"source":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"},{"source":"VirusBulletin Kimsuky October 2019","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"},{"source":"ThreatConnect Kimsuky September 2020","url":"https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"}]},{"technique_id":"T1204.004","description":"Kimsuky has leveraged ClickFix type tactics enticing victims to copy and paste malicious code.","sources":[{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}]},{"technique_id":"T1205","description":"Kimsuky has used TRANSLATEXT to redirect clients to legitimate Gmail, Naver or Kakao pages if the clients connect with no parameters.","sources":[{"source":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"technique_id":"T1217","description":"Kimsuky has collected sensitive browser data using the function GetBrowserData() to include login credentials, bookmarks, cookies, and encryption keys.","sources":[{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1218.005","description":"Kimsuky has used mshta.exe to run malicious scripts on the system.","sources":[{"source":"EST Kimsuky April 2019","url":"https://blog.alyac.co.kr/2234"},{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1218.010","description":"Kimsuky has executed malware with regsvr32s.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1218.011","description":"Kimsuky has used rundll32.exe to execute malicious scripts and malware on a victim's network.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1219.002","description":"Kimsuky has used a modified TeamViewer client as a command and control channel.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}]},{"technique_id":"T1480.002","description":"Kimsuky has utilized a mutex to detect whether its malware is actively running on the victim host. Kimsuky has leveraged PowerShell to store the Process ID (PID) of the currently running malicious PowerShell script into a file named pid.txt which is saved locally on the victim host in the %TEMP% Directory and is queried prior to execution of subsequent PowerShell script to prevent duplication.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1489","description":"Kimsuky has disabled actively running virtual environments using the KillMe function to include VMware, Microsoft Hypervisors, and VirtualBox.","sources":[{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1497.001","description":"Kimsuky has detected and killed virtual environments by using the PowerShell cmdlet Get-CimInstance that searches the classname of the computer system manufacturer through an if statement of if($computerSystem.Manufacturer -match \"VMware\" -or $computerSystem.Manufacturer -match \"Microsoft\" -or $computerSystem.Manufacturer -match \"VirtualBox\").","sources":[{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1505.003","description":"Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding \"Dinosaur\" references within the code.","sources":[{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"}]},{"technique_id":"T1518.001","description":"Kimsuky has checked for the presence of antivirus software with powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct. Kimsuky has also obtained details on antivirus software through WMI queries using Win32_OperatingSystem and SecurityCenter2.AntiVirusProduct. Kimsuky has also checked the status of Windows Defender through the use cmd /s sc query WinDefend.","sources":[{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1534","description":"Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1539","description":"Kimsuky has used malware, such as TRANSLATEXT, to steal and exfiltrate browser cookies.","sources":[{"source":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"},{"source":"Zscaler Kimsuky TRANSLATEXT","url":"https://www.zscaler.com/blogs/security-research/kimsuky-deploys-translatext-target-south-korean-academia#technical-analysis"}]},{"technique_id":"T1543.003","description":"Kimsuky has created new services for persistence.","sources":[{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"}]},{"technique_id":"T1546.001","description":"Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.","sources":[{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}]},{"technique_id":"T1547.001","description":"Kimsuky has placed scripts in the startup folder for persistence and modified the HKEY_CURRENT_USER\\Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce Registry key.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}]},{"technique_id":"T1550.002","description":"Kimsuky has used pass the hash for authentication to remote access software used in C2.","sources":[{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"}]},{"technique_id":"T1552.001","description":"Kimsuky has used tools that are capable of obtaining credentials from saved mail.","sources":[{"source":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"}]},{"technique_id":"T1552.004","description":"Kimsuky has accessed a Local State files associated with Chromium-based browsers that contain the AES key used to encrypt passwords stored in the browser to include app_bound_encrypted_key.","sources":[{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1553.002","description":"Kimsuky has signed files with the name EGIS CO,. Ltd. and has stolen a valid certificate that is used to sign the malware and the dropper.","sources":[{"source":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"},{"source":"ThreatConnect Kimsuky September 2020","url":"https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"}]},{"technique_id":"T1555.003","description":"Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"},{"source":"Zdnet Kimsuky Dec 2018","url":"https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/"},{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"}]},{"technique_id":"T1557","description":"Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.","sources":[{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"}]},{"technique_id":"T1559.001","description":"Kimsuky has leveraged Component Object Model (COM) to create scheduled tasks to include using naming conventions that mimic legitimate applications. Kimsuky has leveraged obfuscation VBScript to form a string in WScript.Shell which has downloaded a malicious payload to the victim environment.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1560.001","description":"Kimsuky has used QuickZip to archive stolen files before exfiltration. Kimsuky has used the Send() function to compress all collected data into a zip file named init,.zip, then renames it to init.dat, before exfiltration.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1560.003","description":"Kimsuky has used RC4 encryption before exfil.","sources":[{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}]},{"technique_id":"T1564.002","description":"Kimsuky has run reg add ‘HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList’ /v to hide a newly created user.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1564.003","description":"Kimsuky has used an information gathering module that will hide an AV software window from the victim. Kimsuky has also been known to use -WindowStyle Hidden to conceal PowerShell windows.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1564.011","description":"Kimsuky has leveraged the PowerShell -ErrorAction SilentlyContinue command to continue execution through system events.","sources":[{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1566","description":"Kimsuky has used spearphishing to gain initial access and intelligence.","sources":[{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"},{"source":"MSFT-AI","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"}]},{"technique_id":"T1566.001","description":"Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns. Kimsuky has also distributed emails with attached compressed zip files that contained malicious .LNK files masquerading as legitimate files. Kimsuky has delivered tailored PDF documents that contain malicious links.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Zdnet Kimsuky Dec 2018","url":"https://www.zdnet.com/article/cyber-espionage-group-uses-chrome-extension-to-infect-victims/"},{"source":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"},{"source":"VirusBulletin Kimsuky October 2019","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"},{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source":"ThreatConnect Kimsuky September 2020","url":"https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"}]},{"technique_id":"T1566.002","description":"Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.","sources":[{"source":"EST Kimsuky April 2019","url":"https://blog.alyac.co.kr/2234"},{"source":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1567.002","description":"Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts. Kimsuky has also leveraged Dropbox for uploading victim system information.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"}]},{"technique_id":"T1568","description":"Kimsuky has used Dynamic DNS (DDNS) services, such as FreeDNS or No-IP DDNS, to include servers located in South Korea.","sources":[{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}]},{"technique_id":"T1583","description":"Kimsuky has used funds from stolen and laundered cryptocurrency to acquire operational infrastructure.","sources":[{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"technique_id":"T1583.001","description":"Kimsuky has registered domains to spoof targeted organizations and trusted third parties including search engines, web platforms, and cryptocurrency exchanges.","sources":[{"source":"Zdnet Kimsuky Group September 2020","url":"https://www.zdnet.com/article/north-korea-has-tried-to-hack-11-officials-of-the-un-security-council/"},{"source":"CISA AA20-301A Kimsuky","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-301a"},{"source":"Cybereason Kimsuky November 2020","url":"https://www.cybereason.com/blog/back-to-the-future-inside-the-kimsuky-kgh-spyware-suite"},{"source":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"},{"source":"ThreatConnect Kimsuky September 2020","url":"https://threatconnect.com/blog/kimsuky-phishing-operations-putting-in-work/"}]},{"technique_id":"T1583.004","description":"Kimsuky has purchased hosting servers with virtual currency and prepaid cards.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1583.006","description":"Kimsuky has hosted content used for targeting efforts via web services such as Blogspot. Kimsuky has also leveraged Dropbox for hosting payloads and uploading victim system information.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"}]},{"technique_id":"T1584.001","description":"Kimsuky has compromised legitimate sites and used them to distribute malware.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"technique_id":"T1585","description":"Kimsuky has leveraged stolen PII to create accounts.","sources":[{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"technique_id":"T1585.001","description":"Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1585.002","description":"Kimsuky has created email accounts for phishing operations.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Proofpoint TA427 April 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering"},{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"technique_id":"T1586.002","description":"Kimsuky has compromised email accounts to send spearphishing e-mails.","sources":[{"source":"VirusBulletin Kimsuky October 2019","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"},{"source":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"technique_id":"T1587","description":"Kimsuky created and used a mailing toolkit to use in spearphishing attacks.","sources":[{"source":"VirusBulletin Kimsuky October 2019","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"}]},{"technique_id":"T1587.001","description":"Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"technique_id":"T1588.002","description":"Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Netscout Stolen Pencil Dec 2018","url":"https://asert.arbornetworks.com/stolen-pencil-campaign-targets-academia/"},{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"technique_id":"T1588.003","description":"Kimsuky has stolen a valid certificate that is used to sign the malware and the dropper.","sources":[{"source":"S2W Troll Stealer 2024","url":"https://medium.com/s2wblog/kimsuky-disguised-as-a-korean-company-signed-with-a-valid-certificate-to-distribute-troll-stealer-cfa5d54314e2"}]},{"technique_id":"T1588.005","description":"Kimsuky has obtained exploit code for various CVEs.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1589.002","description":"Kimsuky has collected valid email addresses including personal accounts that were subsequently used for spearphishing and other forms of social engineering.","sources":[{"source":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"},{"source":"Proofpoint TA427 April 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering"},{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"technique_id":"T1589.003","description":"Kimsuky has collected victim employee name information.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1591","description":"Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others. Kimsuky has also used large language models (LLMs) to gather information about potential targets of interest.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"MSFT-AI","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"}]},{"technique_id":"T1593.001","description":"Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.","sources":[{"source":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"}]},{"technique_id":"T1593.002","description":"Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1594","description":"Kimsuky has searched for information on the target company's website.","sources":[{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"}]},{"technique_id":"T1596","description":"Kimsuky has used LLMs to better understand publicly reported vulnerabilities.","sources":[{"source":"MSFT-AI","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"},{"source":"OpenAI-CTI","url":"https://openai.com/index/disrupting-malicious-uses-of-ai-by-state-affiliated-threat-actors/"}]},{"technique_id":"T1598","description":"Kimsuky has used tailored spearphishing emails to gather victim information including contat lists to identify additional targets.","sources":[{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"technique_id":"T1598.003","description":"Kimsuky has used links in e-mail to steal account information including web beacons for target profiling. Kimsuky has also utilized QR codes (also known as Quishing) to direct victims to malicious links through the reliance of a mobile device to scan a code with an embedded malicious URL.","sources":[{"source":"EnkiWhiteHat_KimsukyDOCSWAP_Dec2025","url":"https://www.enki.co.kr/en/media-center/blog/kimsuky-distributing-malicious-mobile-app-via-qr-code"},{"source":"FBI_KimsukyQR_Jan2026","url":"https://www.ic3.gov/CSA/2026/260108.pdf"},{"source":"Malwarebytes Kimsuky June 2021","url":"https://blog.malwarebytes.com/threat-analysis/2021/06/kimsuky-apt-continues-to-target-south-korean-government-using-appleseed-backdoor/"},{"source":"VirusBulletin Kimsuky October 2019","url":"https://www.virusbulletin.com/virusbulletin/2020/03/vb2019-paper-kimsuky-group-tracking-king-spearphishing/"},{"source":"KISA Operation Muzabi","url":"https://web.archive.org/web/20220328121326/https://boho.or.kr/filedownload.do?attach_file_seq=2695&attach_file_id=EpF2695.pdf"},{"source":"Proofpoint TA427 April 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/social-engineering-dmarc-abuse-ta427s-art-information-gathering"}]},{"technique_id":"T1608.001","description":"Kimsuky has used compromised and acquired infrastructure to host and deliver malware including Blogspot to host beacons, file exfiltrators, and implants. Kimsuky has also hosted malicious payloads on Dropbox.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"technique_id":"T1620","description":"Kimsuky has used the Invoke-Mimikatz PowerShell script to reflectively load a Mimikatz credential stealing DLL into memory. Kimsuky has also used reflective loading through .NET assembly using [System.Reflection.Assembly]::Load.","sources":[{"source":"Securonix Kimsuky February 2025","url":"https://www.securonix.com/blog/analyzing-deepdrive-north-korean-threat-actors-observed-exploiting-trusted-platforms-for-targeted-attacks/"},{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"technique_id":"T1657","description":"Kimsuky has stolen and laundered cryptocurrency to self-fund operations including the acquisition of infrastructure.","sources":[{"source":"Mandiant APT43 March 2024","url":"https://services.google.com/fh/files/misc/apt43-report-en.pdf"}]},{"technique_id":"T1678","description":"Kimsuky has utilized the Sleep function to ensure execution of scripts.","sources":[{"source":"Gen Digital Kimsuky HTTPTroy October 2025","url":"https://www.gendigital.com/blog/insights/research/dprk-kimsuky-lazarus-analysis"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1680","description":"Kimsuky has enumerated drives.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"},{"source":"Aryaka Kimsuky July 2025","url":"https://www.aryaka.com/docs/reports/aryaka-kimsuky-apt-operational-blueprint.pdf"}]},{"technique_id":"T1682","description":"Kimsuky has used LLMs to identify think tanks, government organizations, and experts to inform targeting for spearphishing campaigns.","sources":[{"source":"MSFT-AI","url":"https://www.microsoft.com/en-us/security/blog/2024/02/14/staying-ahead-of-threat-actors-in-the-age-of-ai/"}]},{"technique_id":"T1684.001","description":"Kimsuky has also impersonated legitimate people, such as a foreign advisor, an embassy employee, and a think tank employee. Kimsuky has also purported to be a Japanese diplomat to communicate with the victims.","sources":[{"source":"FBI_KimsukyQR_Jan2026","url":"https://www.ic3.gov/CSA/2026/260108.pdf"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}]},{"technique_id":"T1685","description":"Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.","sources":[{"source":"Talos Kimsuky Nov 2021","url":"https://blog.talosintelligence.com/2021/11/kimsuky-abuses-blogs-delivers-malware.html"},{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}]},{"technique_id":"T1686","description":"Kimsuky has been observed disabling the system firewall.","sources":[{"source":"Securelist Kimsuky Sept 2013","url":"https://securelist.com/the-kimsuky-operation-a-north-korean-apt/57915/"}]}]},{"id":"G1004","name":"LAPSUS$","procedures":[{"technique_id":"T1003.003","description":"LAPSUS$ has used Windows built-in tool ntdsutil to extract the Active Directory (AD) database.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1003.006","description":"LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1005","description":"LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1068","description":"LAPSUS$ has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1069.002","description":"LAPSUS$ has used the AD Explorer tool to enumerate groups on a victim's network.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1078","description":"LAPSUS$ has used compromised credentials and/or session tokens to gain access into a victim's VPN, VDI, RDP, and IAMs.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1078.004","description":"LAPSUS$ has used compromised credentials to access cloud assets within a target organization.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1087.002","description":"LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1090","description":"LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1098.003","description":"LAPSUS$ has added the global admin role to accounts they have created in the targeted organization's cloud instances.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1111","description":"LAPSUS$ has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1114.003","description":"LAPSUS$ has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1133","description":"LAPSUS$ has gained access to internet-facing systems and applications, including virtual private network (VPN), remote desktop protocol (RDP), and virtual desktop infrastructure (VDI) including Citrix.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1136.003","description":"LAPSUS$ has created global admin accounts in the targeted organization's cloud instances to gain persistence.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1199","description":"LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1204","description":"LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing LAPSUS$ to take control of an authenticated system.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1213.001","description":"LAPSUS$ has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1213.002","description":"LAPSUS$ has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1213.003","description":"LAPSUS$ has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1213.005","description":"LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1485","description":"LAPSUS$ has deleted the target's systems and resources both on-premises and in the cloud.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1489","description":"LAPSUS$ has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"}]},{"technique_id":"T1531","description":"LAPSUS$ has removed a targeted organization's global admin accounts to lock the organization out of all access.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1552.008","description":"LAPSUS$ has targeted various collaboration tools like Slack, Teams, JIRA, Confluence, and others to hunt for exposed credentials to support privilege escalation and lateral movement.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1555.003","description":"LAPSUS$ has obtained passwords and session tokens with the use of the Redline password stealer.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1555.005","description":"LAPSUS$ has accessed local password managers and databases to obtain further credentials from a compromised network.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"}]},{"technique_id":"T1578.002","description":"LAPSUS$ has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1578.003","description":"LAPSUS$ has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1583.003","description":"LAPSUS$ has used VPS hosting providers for infrastructure.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1584.002","description":"LAPSUS$ has reconfigured a victim's DNS records to actor-controlled domains and websites.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"}]},{"technique_id":"T1586.002","description":"LAPSUS$ has payed employees, suppliers, and business partners of target organizations for credentials.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1588.001","description":"LAPSUS$ acquired and used the Redline password stealer in their operations.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1588.002","description":"LAPSUS$ has obtained tools such as RVTools and AD Explorer for their operations.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1589","description":"LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1589.001","description":"LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.","sources":[{"source":"NCC Group LAPSUS Apr 2022","url":"https://www.nccgroup.com/research-blog/lapsus-recent-techniques-tactics-and-procedures/"},{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1589.002","description":"LAPSUS$ has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1591.002","description":"LAPSUS$ has gathered detailed knowledge of an organization's supply chain relationships.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1591.004","description":"LAPSUS$ has gathered detailed knowledge of team structures within a target organization.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1593.003","description":"LAPSUS$ has searched public code repositories for exposed credentials.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1597.002","description":"LAPSUS$ has purchased credentials and session tokens from criminal underground forums.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1598.004","description":"LAPSUS$ has called victims' help desk to convince the support personnel to reset a privileged account’s credentials.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1621","description":"LAPSUS$ has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"technique_id":"T1684.001","description":"LAPSUS$ has called victims' help desk and impersonated legitimate users with previously gathered information in order to gain access to privileged accounts.","sources":[{"source":"MSTIC DEV-0537 Mar 2022","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]}]},{"id":"G0032","name":"Lazarus Group","procedures":[{"technique_id":"T1001.003","description":"Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"McAfee-GhostSecret-fixurl","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}]},{"technique_id":"T1005","description":"Lazarus Group has collected data and files from compromised networks.","sources":[{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1008","description":"Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.","sources":[{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1010","description":"Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.","sources":[{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster Tools","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1012","description":"Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\\Software\\Bitcoin\\Bitcoin-Qt.","sources":[{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}]},{"technique_id":"T1016","description":"Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.","sources":[{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1021.001","description":"Lazarus Group malware SierraCharlie uses RDP for propagation.","sources":[{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1021.002","description":"Lazarus Group malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement.","sources":[{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1021.004","description":"Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1027.007","description":"Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.","sources":[{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"technique_id":"T1027.009","description":"Lazarus Group has distributed malicious payloads embedded in PNG files.","sources":[{"source":"Microsoft DiamondSleet 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/11/22/diamond-sleet-supply-chain-compromise-distributes-a-modified-cyberlink-installer/"}]},{"technique_id":"T1027.013","description":"Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.","sources":[{"source":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}]},{"technique_id":"T1033","description":"Various Lazarus Group malware enumerates logged-on users.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}]},{"technique_id":"T1036.003","description":"Lazarus Group has renamed system utilities such as wscript.exe and mshta.exe.","sources":[{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}]},{"technique_id":"T1036.004","description":"Lazarus Group has used a scheduled task named SRCheck to mask the execution of a malicious .dll.","sources":[{"source":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"}]},{"technique_id":"T1036.005","description":"Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.","sources":[{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source":"CISA MAR-10288834-2.v1  TAINTEDSCRIBE MAY 2020","url":"https://us-cert.cisa.gov/ncas/analysis-reports/ar20-133b"}]},{"technique_id":"T1041","description":"Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.","sources":[{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}]},{"technique_id":"T1046","description":"Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1047","description":"Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.","sources":[{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1048.003","description":"Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.","sources":[{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1049","description":"Lazarus Group has used net use to identify and establish a network connection with a remote host.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1053.005","description":"Lazarus Group has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.","sources":[{"source":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}]},{"technique_id":"T1055.001","description":"A Lazarus Group malware sample performs reflective DLL injection.","sources":[{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"technique_id":"T1056.001","description":"Lazarus Group malware KiloAlfa contains keylogging functionality.","sources":[{"source":"Novetta Blockbuster Tools","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1057","description":"Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.","sources":[{"source":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"technique_id":"T1059.001","description":"Lazarus Group has used PowerShell to execute commands and malicious code.","sources":[{"source":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}]},{"technique_id":"T1059.003","description":"Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"},{"source":"US-CERT SHARPKNOT June 2018","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"}]},{"technique_id":"T1059.005","description":"Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.","sources":[{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"technique_id":"T1070","description":"Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.","sources":[{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"technique_id":"T1070.003","description":"Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1070.004","description":"Lazarus Group malware has deleted files in various ways, including \"suicide scripts\" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.","sources":[{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"technique_id":"T1070.006","description":"Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"technique_id":"T1071.001","description":"Lazarus Group has conducted C2 over HTTP and HTTPS.","sources":[{"source":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"},{"source":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"}]},{"technique_id":"T1074.001","description":"Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.","sources":[{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1078","description":"Lazarus Group has used administrator credentials to gain access to restricted network segments.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1082","description":"Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"technique_id":"T1083","description":"Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.","sources":[{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"technique_id":"T1090.001","description":"Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1090.002","description":"Lazarus Group has used multiple proxies to obfuscate network traffic from victims.","sources":[{"source":"US-CERT FALLCHILL Nov 2017","url":"https://www.us-cert.gov/ncas/alerts/TA17-318A"},{"source":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"}]},{"technique_id":"T1098","description":"Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1102.002","description":"Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.","sources":[{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"technique_id":"T1104","description":"Lazarus Group has used multi-stage malware components that inject later stages into separate processes.","sources":[{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"technique_id":"T1105","description":"Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.","sources":[{"source":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"},{"source":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"},{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"},{"source":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}]},{"technique_id":"T1106","description":"Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.","sources":[{"source":"McAfee Lazarus Jul 2020","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/operation-north-star-a-job-offer-thats-too-good-to-be-true/?hilite=%27Operation%27%2C%27North%27%2C%27Star%27"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}]},{"technique_id":"T1110.003","description":"Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.","sources":[{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1124","description":"A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.","sources":[{"source":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"technique_id":"T1132.001","description":"A Lazarus Group malware sample encodes data with base64.","sources":[{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}]},{"technique_id":"T1134.002","description":"Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.","sources":[{"source":"Novetta Blockbuster Tools","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1140","description":"Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.","sources":[{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"technique_id":"T1189","description":"Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.","sources":[{"source":"RATANKBA","url":"https://www.trendmicro.com/en_us/research/17/b/ratankba-watering-holes-against-enterprises.html"},{"source":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}]},{"technique_id":"T1202","description":"Lazarus Group persistence mechanisms have used forfiles.exe to execute .htm files.","sources":[{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}]},{"technique_id":"T1203","description":"Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.","sources":[{"source":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"}]},{"technique_id":"T1204.002","description":"Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.","sources":[{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"},{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1218","description":"Lazarus Group lnk files used for persistence have abused the Windows Update Client (wuauclt.exe) to execute a malicious DLL.","sources":[{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}]},{"technique_id":"T1218.005","description":"Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.","sources":[{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}]},{"technique_id":"T1218.011","description":"Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.","sources":[{"source":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"}]},{"technique_id":"T1485","description":"Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.","sources":[{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1489","description":"Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"}]},{"technique_id":"T1491.001","description":"Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"}]},{"technique_id":"T1529","description":"Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.","sources":[{"source":"US-CERT SHARPKNOT June 2018","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"}]},{"technique_id":"T1542.003","description":"Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1543.003","description":"Several Lazarus Group malware families install themselves as new services.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1547.001","description":"Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.","sources":[{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}]},{"technique_id":"T1547.009","description":"Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.","sources":[{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}]},{"technique_id":"T1553.002","description":"Lazarus Group has digitally signed malware and utilities to evade detection.","sources":[{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"technique_id":"T1557.001","description":"Lazarus Group executed Responder using the command [Responder file path] -i [IP address] -rPv on a compromised host to harvest credentials and move laterally.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1560","description":"Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2.","sources":[{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}]},{"technique_id":"T1560.002","description":"Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.","sources":[{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}]},{"technique_id":"T1560.003","description":"A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.","sources":[{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"}]},{"technique_id":"T1561.001","description":"Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"}]},{"technique_id":"T1561.002","description":"Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record (MBR) on the victim's machine and has possessed MBR wiper malware since at least 2009.","sources":[{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"US-CERT SHARPKNOT June 2018","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"}]},{"technique_id":"T1564.001","description":"Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.","sources":[{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source":"SentinelOne Lazarus macOS July 2020","url":"https://www.sentinelone.com/blog/four-distinct-families-of-lazarus-malware-target-apples-macos-platform/"},{"source":"TrendMicro macOS Dacls May 2020","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/new-macos-dacls-rat-backdoor-show-lazarus-multi-platform-attack-capability/"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"}]},{"technique_id":"T1566.001","description":"Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.","sources":[{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"McAfee Bankshot","url":"https://securingtomorrow.mcafee.com/mcafee-labs/hidden-cobra-targets-turkish-financial-sector-new-bankshot-implant/"},{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1566.002","description":"Lazarus Group has sent malicious links to victims via email.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1566.003","description":"Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.","sources":[{"source":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}]},{"technique_id":"T1571","description":"Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.","sources":[{"source":"Novetta Blockbuster RATs","url":"https://web.archive.org/web/20220608001455/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-RAT-and-Staging-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"technique_id":"T1573.001","description":"Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"technique_id":"T1574.001","description":"Lazarus Group has replaced win_fw.dll, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload. Lazarus Group utilized DLL side-loading to execute malicious payloads through abuse of the legitimate processes wsmprovhost.exe and dfrgui.exe.","sources":[{"source":"ASEC Lazarus 2022","url":"https://asec.ahnlab.com/en/39828/"},{"source":"ESET Twitter Ida Pro Nov 2021","url":"https://x.com/ESETresearch/status/1458438155149922312"}]},{"technique_id":"T1574.013","description":"Lazarus Group has abused the KernelCallbackTable to hijack process control flow and execute shellcode.","sources":[{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}]},{"technique_id":"T1583.001","description":"Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.","sources":[{"source":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"},{"source":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}]},{"technique_id":"T1583.006","description":"Lazarus Group has hosted malicious downloads on Github.","sources":[{"source":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}]},{"technique_id":"T1584.004","description":"Lazarus Group has compromised servers to stage malicious tools.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1585.001","description":"Lazarus Group has created new Twitter accounts to conduct social engineering against potential victims.","sources":[{"source":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}]},{"technique_id":"T1585.002","description":"Lazarus Group has created new email accounts for spearphishing operations.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1587.001","description":"Lazarus Group has developed custom malware for use in their operations.","sources":[{"source":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"},{"source":"Google TAG Lazarus Jan 2021","url":"https://blog.google/threat-analysis-group/new-campaign-targeting-security-researchers/"}]},{"technique_id":"T1588.002","description":"Lazarus Group has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1588.004","description":"Lazarus Group has obtained SSL certificates for their C2 domains.","sources":[{"source":"CISA AppleJeus Feb 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-048a"}]},{"technique_id":"T1589.002","description":"Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1591","description":"Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.","sources":[{"source":"Kaspersky ThreatNeedle Feb 2021","url":"https://securelist.com/lazarus-threatneedle/100803/"}]},{"technique_id":"T1620","description":"Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.","sources":[{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"Qualys LolZarus","url":"https://blog.qualys.com/vulnerabilities-threat-research/2022/02/08/lolzarus-lazarus-group-incorporating-lolbins-into-campaigns"}]},{"technique_id":"T1680","description":"A Destover-like variant used by Lazarus Group collects disk space information and sends it to its C2 server.","sources":[{"source":"Novetta Blockbuster Destructive Malware","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"Lazarus APT January 2022","url":"https://blog.malwarebytes.com/threat-intelligence/2022/01/north-koreas-lazarus-apt-leverages-windows-update-client-github-in-latest-campaign/"},{"source":"McAfee Lazarus Resurfaces Feb 2018","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs/lazarus-resurfaces-targets-global-banks-bitcoin-users/"},{"source":"McAfee GhostSecret","url":"https://securingtomorrow.mcafee.com/mcafee-labs/analyzing-operation-ghostsecret-attack-seeks-to-steal-data-worldwide/"}]},{"technique_id":"T1685","description":"Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services..","sources":[{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster Tools","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"},{"source":"US-CERT SHARPKNOT June 2018","url":"https://www.us-cert.gov/sites/default/files/publications/MAR-10135536.11.WHITE.pdf"}]},{"technique_id":"T1686.003","description":"Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh.","sources":[{"source":"Novetta Blockbuster Loaders","url":"https://web.archive.org/web/20190508165631/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Loaders-Installers-and-Uninstallers-Report.pdf"},{"source":"Novetta Blockbuster Tools","url":"https://web.archive.org/web/20220425194457/https://operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Tools-Report.pdf"},{"source":"Novetta Blockbuster","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]}]},{"id":"G0140","name":"LazyScripter","procedures":[{"technique_id":"T1027.010","description":"LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1036","description":"LazyScripter has used several different security software icons to disguise executables.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1059.001","description":"LazyScripter has used PowerShell scripts to execute malicious code.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1059.003","description":"LazyScripter has used batch files to deploy open-source and multi-stage RATs.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1059.005","description":"LazyScripter has used VBScript to execute malicious code.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1059.007","description":"LazyScripter has used JavaScript in its attacks.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1071.004","description":"LazyScripter has leveraged dynamic DNS providers for C2 communications.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1102","description":"LazyScripter has used GitHub to host its payloads to operate spam campaigns.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1105","description":"LazyScripter had downloaded additional tools to a compromised host.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1204.001","description":"LazyScripter has relied upon users clicking on links to malicious files.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1204.002","description":"LazyScripter has lured users to open malicious email attachments.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1218.005","description":"LazyScripter has used mshta.exe to execute Koadic stagers.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1218.011","description":"LazyScripter has used rundll32.exe to execute Koadic stagers.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1547.001","description":"LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1566.001","description":"LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1566.002","description":"LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1583.001","description":"LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1583.006","description":"LazyScripter has established GitHub accounts to host its toolsets.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1588.001","description":"LazyScripter has used a variety of open-source remote access Trojans for its operations.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]},{"technique_id":"T1608.001","description":"LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.","sources":[{"source":"MalwareBytes LazyScripter Feb 2021","url":"https://web.archive.org/web/20211003035156/https://www.malwarebytes.com/resources/files/2021/02/lazyscripter.pdf"}]}]},{"id":"G0077","name":"Leafminer","procedures":[{"technique_id":"T1003.001","description":"Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1003.004","description":"Leafminer used several tools for retrieving login and password information, including LaZagne.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1003.005","description":"Leafminer used several tools for retrieving login and password information, including LaZagne.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1018","description":"Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1027.010","description":"Leafminer obfuscated scripts that were used on victim machines.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1046","description":"Leafminer scanned network services to search for vulnerabilities in the victim system.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1055.013","description":"Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1059.007","description":"Leafminer infected victims using JavaScript code.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1083","description":"Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1110.003","description":"Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1114.002","description":"Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1136.001","description":"Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1189","description":"Leafminer has infected victims using watering holes.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1552.001","description":"Leafminer used several tools for retrieving login and password information, including LaZagne.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1555","description":"Leafminer used several tools for retrieving login and password information, including LaZagne.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1555.003","description":"Leafminer used several tools for retrieving login and password information, including LaZagne.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]},{"technique_id":"T1588.002","description":"Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.","sources":[{"source":"Symantec Leafminer July 2018","url":"https://www.symantec.com/blogs/threat-intelligence/leafminer-espionage-middle-east"}]}]},{"id":"G0065","name":"Leviathan","procedures":[{"technique_id":"T1003","description":"Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.","sources":[{"source":"FireEye APT40 March 2019","url":"https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"}]},{"technique_id":"T1003.001","description":"Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.","sources":[{"source":"FireEye APT40 March 2019","url":"https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"}]},{"technique_id":"T1021.001","description":"Leviathan has targeted RDP credentials and used it to move through the victim environment.","sources":[{"source":"FireEye APT40 March 2019","url":"https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"}]},{"technique_id":"T1021.004","description":"Leviathan used ssh for internal reconnaissance.","sources":[{"source":"FireEye APT40 March 2019","url":"https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"}]},{"technique_id":"T1027.001","description":"Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"technique_id":"T1027.003","description":"Leviathan has used steganography to hide stolen data inside other files stored on Github.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1027.013","description":"Leviathan has obfuscated code using base64.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"technique_id":"T1027.015","description":"Leviathan has obfuscated code using gzip compression.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"technique_id":"T1041","description":"Leviathan has exfiltrated data over its C2 channel.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1047","description":"Leviathan has used WMI for execution.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"technique_id":"T1055.001","description":"Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.","sources":[{"source":"Accenture MUDCARP March 2019","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"}]},{"technique_id":"T1059.001","description":"Leviathan has used PowerShell for execution.","sources":[{"source":"Accenture MUDCARP March 2019","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"},{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"},{"source":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"technique_id":"T1059.005","description":"Leviathan has used VBScript.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"technique_id":"T1074.001","description":"Leviathan has used C:\\Windows\\Debug and C:\\Perflogs as staging directories.","sources":[{"source":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"},{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1074.002","description":"Leviathan has staged data remotely prior to exfiltration.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1078","description":"Leviathan has obtained valid accounts to gain initial access.","sources":[{"source":"Accenture MUDCARP March 2019","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"},{"source":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"},{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1090.003","description":"Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1102.003","description":"Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.","sources":[{"source":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"technique_id":"T1105","description":"Leviathan has downloaded additional scripts and files from adversary-controlled servers.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"technique_id":"T1133","description":"Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1140","description":"Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"technique_id":"T1189","description":"Leviathan has infected victims using watering holes.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1190","description":"Leviathan has used exploits against publicly-disclosed vulnerabilities for initial access into victim networks.","sources":[{"source":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"}]},{"technique_id":"T1197","description":"Leviathan has used BITSAdmin to download additional tools.","sources":[{"source":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"technique_id":"T1203","description":"Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.","sources":[{"source":"Accenture MUDCARP March 2019","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"},{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"},{"source":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"technique_id":"T1204.001","description":"Leviathan has sent spearphishing email links attempting to get a user to click.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1204.002","description":"Leviathan has sent spearphishing attachments attempting to get a user to click.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1218.010","description":"Leviathan has used regsvr32 for execution.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"}]},{"technique_id":"T1505.003","description":"Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.","sources":[{"source":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"},{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"},{"source":"FireEye APT40 March 2019","url":"https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"}]},{"technique_id":"T1534","description":"Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1546.003","description":"Leviathan has used WMI for persistence.","sources":[{"source":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"technique_id":"T1547.001","description":"Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"technique_id":"T1547.009","description":"Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"technique_id":"T1553.002","description":"Leviathan has used stolen code signing certificates to sign malware.","sources":[{"source":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"},{"source":"FireEye APT40 March 2019","url":"https://www.fireeye.com/blog/threat-research/2019/03/apt40-examining-a-china-nexus-espionage-actor.html"}]},{"technique_id":"T1559.002","description":"Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.","sources":[{"source":"Accenture MUDCARP March 2019","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"}]},{"technique_id":"T1560","description":"Leviathan has archived victim's data prior to exfiltration.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1566.001","description":"Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1566.002","description":"Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1567.002","description":"Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.","sources":[{"source":"Proofpoint Leviathan Oct 2017","url":"https://www.proofpoint.com/us/threat-insight/post/leviathan-espionage-actor-spearphishes-maritime-and-defense-targets"},{"source":"FireEye Periscope March 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/suspected-chinese-espionage-group-targeting-maritime-and-engineering-industries.html"}]},{"technique_id":"T1572","description":"Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1583.001","description":"Leviathan has established domains that impersonate legitimate entities to use for targeting efforts.","sources":[{"source":"Accenture MUDCARP March 2019","url":"https://web.archive.org/web/20210722005437/https://www.accenture.com/_acnmedia/PDF-96/Accenture-Security-MUDCARP.pdf"},{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1584.004","description":"Leviathan has used compromised legitimate websites as command and control nodes for operations.","sources":[{"source":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"}]},{"technique_id":"T1584.008","description":"Leviathan has used compromised networking devices, such as small office/home office (SOHO) devices, as operational command and control infrastructure.","sources":[{"source":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"}]},{"technique_id":"T1585.001","description":"Leviathan has created new social media accounts for targeting efforts.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1585.002","description":"Leviathan has created new email accounts for targeting efforts.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1586.001","description":"Leviathan has compromised social media accounts to conduct social engineering attacks.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1586.002","description":"Leviathan has compromised email accounts to conduct social engineering attacks.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1587.004","description":"Leviathan has rapidly transformed and adapted public exploit proof-of-concept code for new vulnerabilities and utilized them against target networks.","sources":[{"source":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"}]},{"technique_id":"T1589.001","description":"Leviathan has collected compromised credentials to use for targeting efforts.","sources":[{"source":"CISA AA21-200A APT40 July 2021","url":"https://us-cert.cisa.gov/ncas/alerts/aa21-200a"}]},{"technique_id":"T1595.002","description":"Leviathan has conducted reconnaissance against target networks of interest looking for vulnerable, end-of-life, or no longer maintainted devices against which to rapidly deploy exploits.","sources":[{"source":"CISA Leviathan 2024","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-190a"}]}]},{"id":"G0030","name":"Lotus Blossom","procedures":[{"technique_id":"T1012","description":"Lotus Blossom has run commands such as reg query HKLM\\SYSTEM\\CurrentControlSet\\Services\\[service name]\\Parameters to verify if installed implants are running as a service.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1016","description":"Lotus Blossom has used commands such as ipconfig and netstat to gather network information on compromised hosts.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1016.001","description":"Lotus Blossom has performed checks to determine if a victim machine is able to access the Internet.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1018","description":"Lotus Blossom has used Ping to identify remote systems.","sources":[{"source":"Symantec Bilbug 2022","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"technique_id":"T1046","description":"Lotus Blossom has used port scanners to enumerate services on remote hosts.","sources":[{"source":"Symantec Bilbug 2022","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"technique_id":"T1047","description":"Lotus Blossom has used WMI to enable lateral movement.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1049","description":"Lotus Blossom has used commands such as netstat to identify system network connections.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1074.001","description":"Lotus Blossom has locally staged compressed and archived data for follow-on exfiltration.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1083","description":"Lotus Blossom has used commands such as dir to examine the local filesystem of victim machines.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1087.001","description":"Lotus Blossom has used commands such as net to profile local system users.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1087.002","description":"Lotus Blossom has used net commands and tools such as AdFind to profile domain accounts associated with victim machines and make Active Directory queries.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"},{"source":"Symantec Bilbug 2022","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"technique_id":"T1090.001","description":"Lotus Blossom has used publicly available tools such as the Venom proxy tool to proxy traffic out of victim environments.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1090.003","description":"Lotus Blossom has used tools such as the publicly available HTran tool for proxying traffic in victim environments.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1112","description":"Lotus Blossom has installed tools such as Sagerunex by writing them to the Windows registry.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1134","description":"Lotus Blossom has retrieved process tokens for processes to adjust the privileges of the launch process or other items.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1482","description":"Lotus Blossom has used tools such as AdFind to make Active Directory queries.","sources":[{"source":"Symantec Bilbug 2022","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"technique_id":"T1539","description":"Lotus Blossom has used publicly-available tools to steal cookies from browsers such as Chrome.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1543.003","description":"Lotus Blossom has configured tools such as Sagerunex to run as Windows services.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1560.001","description":"Lotus Blossom has used WinRAR for compressing data in RAR format.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"},{"source":"Symantec Bilbug 2022","url":"https://www.security.com/threat-intelligence/espionage-asia-governments-cert-authority"}]},{"technique_id":"T1560.003","description":"Lotus Blossom has used custom tools to compress and archive data on victim systems.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]},{"technique_id":"T1588.002","description":"Lotus Blossom has used publicly-available tools such as a Python-based cookie stealer for Chrome browsers, Impacket, and the Venom proxy tool.","sources":[{"source":"Cisco LotusBlossom 2025","url":"https://blog.talosintelligence.com/lotus-blossom-espionage-group/"}]}]},{"id":"G1014","name":"LuminousMoth","procedures":[{"technique_id":"T1005","description":"LuminousMoth has collected files and data from compromised machines.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1030","description":"LuminousMoth has split archived files into multiple parts to bypass a 5MB limit.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}]},{"technique_id":"T1033","description":"LuminousMoth has used a malicious DLL to collect the username from compromised hosts.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}]},{"technique_id":"T1036.005","description":"LuminousMoth has disguised their exfiltration malware as ZoomVideoApp.exe.","sources":[{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1041","description":"LuminousMoth has used malware that exfiltrates stolen data to its C2 server.","sources":[{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1053.005","description":"LuminousMoth has created scheduled tasks to establish persistence for their tools.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}]},{"technique_id":"T1071.001","description":"LuminousMoth has used HTTP for C2.","sources":[{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1083","description":"LuminousMoth has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1091","description":"LuminousMoth has used malicious DLLs to spread malware to connected removable USB drives on infected machines.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1105","description":"LuminousMoth has downloaded additional malware and tools onto a compromised host.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1112","description":"LuminousMoth has used malware that adds Registry keys for persistence.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1204.001","description":"LuminousMoth has lured victims into clicking malicious Dropbox download links delivered through spearphishing.","sources":[{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1539","description":"LuminousMoth has used an unnamed post-exploitation tool to steal cookies from the Chrome browser.","sources":[{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1547.001","description":"LuminousMoth has used malicious DLLs that setup persistence in the Registry Key HKCU\\Software\\Microsoft\\Windows\\Current Version\\Run.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1553.002","description":"LuminousMoth has signed their malware with a valid digital signature.","sources":[{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1557.002","description":"LuminousMoth has used ARP spoofing to redirect a compromised machine to an actor-controlled website.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}]},{"technique_id":"T1560","description":"LuminousMoth has manually archived stolen files from victim machines before exfiltration.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}]},{"technique_id":"T1564.001","description":"LuminousMoth has used malware to store malicious binaries in hidden directories on victim's USB drives.","sources":[{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1566.002","description":"LuminousMoth has sent spearphishing emails containing a malicious Dropbox download link.","sources":[{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1567.002","description":"LuminousMoth has exfiltrated data to Google Drive.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}]},{"technique_id":"T1574.001","description":"LuminousMoth has used legitimate executables such as winword.exe and igfxem.exe to side-load their malware.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1587.001","description":"LuminousMoth has used unique malware for information theft and exfiltration.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1588.001","description":"LuminousMoth has obtained and used malware such as Cobalt Strike.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"},{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1588.002","description":"LuminousMoth has obtained an ARP spoofing tool from GitHub.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}]},{"technique_id":"T1588.004","description":"LuminousMoth has used a valid digital certificate for some of their malware.","sources":[{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1608.001","description":"LuminousMoth has hosted malicious payloads on Dropbox.","sources":[{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]},{"technique_id":"T1608.004","description":"LuminousMoth has redirected compromised machines to an actor-controlled webpage through HTML injection.","sources":[{"source":"Bitdefender LuminousMoth July 2021","url":"https://www.bitdefender.com/blog/labs/luminousmoth-plugx-file-exfiltration-and-persistence-revisited"}]},{"technique_id":"T1608.005","description":"LuminousMoth has created a link to a Dropbox file that has been used in their spear-phishing operations.","sources":[{"source":"Kaspersky LuminousMoth July 2021","url":"https://securelist.com/apt-luminousmoth/103332/"}]}]},{"id":"G0095","name":"Machete","procedures":[{"technique_id":"T1036.005","description":"Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.","sources":[{"source":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}]},{"technique_id":"T1053.005","description":"Machete has created scheduled tasks to maintain Machete's persistence.","sources":[{"source":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}]},{"technique_id":"T1059.003","description":"Machete has used batch files to initiate additional downloads of malicious files.","sources":[{"source":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}]},{"technique_id":"T1059.005","description":"Machete has embedded malicious macros within spearphishing attachments to download additional files.","sources":[{"source":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}]},{"technique_id":"T1059.006","description":"Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.","sources":[{"source":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}]},{"technique_id":"T1189","description":"Machete has distributed Machete through a fake blog website.","sources":[{"source":"Securelist Machete Aug 2014","url":"https://securelist.com/el-machete/66108/"}]},{"technique_id":"T1204.001","description":"Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.","sources":[{"source":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source":"Securelist Machete Aug 2014","url":"https://securelist.com/el-machete/66108/"},{"source":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}]},{"technique_id":"T1204.002","description":"Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.","sources":[{"source":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source":"Securelist Machete Aug 2014","url":"https://securelist.com/el-machete/66108/"},{"source":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}]},{"technique_id":"T1218.007","description":"Machete has used msiexec to install the Machete malware.","sources":[{"source":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}]},{"technique_id":"T1566.001","description":"Machete has delivered spearphishing emails that contain a zipped file with malicious contents.","sources":[{"source":"Securelist Machete Aug 2014","url":"https://securelist.com/el-machete/66108/"},{"source":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"},{"source":"360 Machete Sep 2020","url":"https://blog.360totalsecurity.com/en/apt-c-43-steals-venezuelan-military-secrets-to-provide-intelligence-support-for-the-reactionaries-hpreact-campaign/"}]},{"technique_id":"T1566.002","description":"Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.","sources":[{"source":"Cylance Machete Mar 2017","url":"https://threatvector.cylance.com/en_us/home/el-machete-malware-attacks-cut-through-latam.html"},{"source":"ESET Machete July 2019","url":"https://www.welivesecurity.com/wp-content/uploads/2019/08/ESET_Machete.pdf"}]}]},{"id":"G0059","name":"Magic Hound","procedures":[{"technique_id":"T1003.001","description":"Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1005","description":"Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1016","description":"Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1016.001","description":"Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1016.002","description":"Magic Hound has collected names and passwords of all Wi-Fi networks to which a device has previously connected.","sources":[{"source":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}]},{"technique_id":"T1018","description":"Magic Hound has used Ping for discovery on targeted networks.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1021.001","description":"Magic Hound has used Remote Desktop Services to copy tools on targeted systems.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1027.010","description":"Magic Hound has used base64-encoded commands.","sources":[{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1027.013","description":"Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.","sources":[{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1033","description":"Magic Hound malware has obtained the victim username and sent it to the C2 server.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1036.004","description":"Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1036.005","description":"Magic Hound has used dllhost.exe to mask Fast Reverse Proxy (FRP) and MicrosoftOutLookUpdater.exe for Plink.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1036.010","description":"Magic Hound has created local accounts named help and DefaultAccount on compromised machines.","sources":[{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1046","description":"Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1047","description":"Magic Hound has used a tool to run cmd /c wmic computersystem get domain for discovery.","sources":[{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1049","description":"Magic Hound has used quser.exe to identify existing RDP connections.","sources":[{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1053.005","description":"Magic Hound has used scheduled tasks to establish persistence and execution.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1056.001","description":"Magic Hound malware is capable of keylogging.","sources":[{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1057","description":"Magic Hound malware can list running processes.","sources":[{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1059.001","description":"Magic Hound has used PowerShell for execution and privilege escalation.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"},{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1059.003","description":"Magic Hound has used the command-line interface for code execution.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1059.005","description":"Magic Hound malware has used VBS scripts for execution.","sources":[{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1070.003","description":"Magic Hound has removed mailbox export requests from compromised Exchange servers.","sources":[{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1070.004","description":"Magic Hound has deleted and overwrote files to cover tracks.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"},{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"}]},{"technique_id":"T1071","description":"Magic Hound malware has used IRC for C2.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1071.001","description":"Magic Hound has used HTTP for C2.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1078.001","description":"Magic Hound enabled and used the default system managed account, DefaultAccount, via \"powershell.exe\" /c net user DefaultAccount /active:yes to connect to a targeted Exchange server over RDP.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1078.002","description":"Magic Hound has used domain administrator accounts after dumping LSASS process memory.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1082","description":"Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1083","description":"Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.","sources":[{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1087.003","description":"Magic Hound has used Powershell to discover email accounts.","sources":[{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1090","description":"Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1098.002","description":"Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.","sources":[{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"}]},{"technique_id":"T1098.007","description":"Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.","sources":[{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1102.002","description":"Magic Hound malware can use a SOAP Web service to communicate with its C2 server.","sources":[{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1105","description":"Magic Hound has downloaded additional code and files from servers onto victims.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1112","description":"Magic Hound has modified Registry settings for security tools.","sources":[{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1113","description":"Magic Hound malware can take a screenshot and upload the file to its C2 server.","sources":[{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1114","description":"Magic Hound has compromised email credentials in order to steal sensitive data.","sources":[{"source":"Certfa Charming Kitten January 2021","url":"https://blog.certfa.com/posts/charming-kitten-christmas-gift/"}]},{"technique_id":"T1114.001","description":"Magic Hound has collected .PST archives.","sources":[{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"}]},{"technique_id":"T1114.002","description":"Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet New-MailboxExportRequest.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1136.001","description":"Magic Hound has created local accounts named help and DefaultAccount on compromised machines.","sources":[{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1189","description":"Magic Hound has conducted watering-hole attacks through media and magazine websites.","sources":[{"source":"ClearSky Kittens Back 3 August 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"}]},{"technique_id":"T1190","description":"Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via \"ProxyShell\" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).","sources":[{"source":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"},{"source":"Cybereason PowerLess February 2022","url":"https://www.cybereason.com/blog/research/powerless-trojan-iranian-apt-phosphorus-adds-new-powershell-backdoor-for-espionage"},{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"Microsoft Log4j Vulnerability Exploitation December 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/12/11/guidance-for-preventing-detecting-and-hunting-for-cve-2021-44228-log4j-2-exploitation/"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1204.001","description":"Magic Hound has attempted to lure victims into opening malicious links embedded in emails.","sources":[{"source":"Certfa Charming Kitten January 2021","url":"https://blog.certfa.com/posts/charming-kitten-christmas-gift/"},{"source":"ClearSky Kittens Back 3 August 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"}]},{"technique_id":"T1204.002","description":"Magic Hound has attempted to lure victims into opening malicious email attachments.","sources":[{"source":"ClearSky Kittens Back 3 August 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"}]},{"technique_id":"T1218.011","description":"Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.","sources":[{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1482","description":"Magic Hound has used a web shell to execute nltest /trusted_domains to identify trust relationships.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1486","description":"Magic Hound has used BitLocker and DiskCryptor to encrypt targeted workstations.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1505.003","description":"Magic Hound has used multiple web shells to gain execution.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1547.001","description":"Magic Hound malware has used Registry Run keys to establish persistence.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1560.001","description":"Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"},{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"}]},{"technique_id":"T1564.003","description":"Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.","sources":[{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1566.002","description":"Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.","sources":[{"source":"Certfa Charming Kitten January 2021","url":"https://blog.certfa.com/posts/charming-kitten-christmas-gift/"},{"source":"ClearSky Kittens Back 3 August 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"},{"source":"Secureworks Cobalt Gypsy Feb 2017","url":"https://www.secureworks.com/blog/iranian-pupyrat-bites-middle-eastern-organizations"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1566.003","description":"Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.","sources":[{"source":"SecureWorks Mia Ash July 2017","url":"https://www.secureworks.com/research/the-curious-case-of-mia-ash"},{"source":"Microsoft Phosphorus Mar 2019","url":"https://blogs.microsoft.com/on-the-issues/2019/03/27/new-steps-to-protect-customers-from-hacking/"},{"source":"ClearSky Kittens Back 3 August 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"}]},{"technique_id":"T1567","description":"Magic Hound has used the Telegram API sendMessage to relay data on compromised devices.","sources":[{"source":"Google Iran Threats October 2021","url":"https://blog.google/threat-analysis-group/countering-threats-iran/"}]},{"technique_id":"T1570","description":"Magic Hound has copied tools within a compromised network using RDP.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1571","description":"Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"Unit 42 Magic Hound Feb 2017","url":"https://researchcenter.paloaltonetworks.com/2017/02/unit42-magic-hound-campaign-attacks-saudi-targets/"}]},{"technique_id":"T1572","description":"Magic Hound has used Plink to tunnel RDP over SSH.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1573","description":"Magic Hound has used an encrypted http proxy in C2 communications.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1583.001","description":"Magic Hound has registered fraudulent domains such as \"mail-newyorker.com\" and \"news12.com.recover-session-service.site\" to target specific victims with phishing attacks.","sources":[{"source":"Certfa Charming Kitten January 2021","url":"https://blog.certfa.com/posts/charming-kitten-christmas-gift/"}]},{"technique_id":"T1583.006","description":"Magic Hound has acquired Amazon S3 buckets to use in C2.","sources":[{"source":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"}]},{"technique_id":"T1584.001","description":"Magic Hound has used compromised domains to host links targeted to specific phishing victims.","sources":[{"source":"Google Iran Threats October 2021","url":"https://blog.google/threat-analysis-group/countering-threats-iran/"},{"source":"Certfa Charming Kitten January 2021","url":"https://blog.certfa.com/posts/charming-kitten-christmas-gift/"},{"source":"ClearSky Kittens Back 3 August 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"},{"source":"Proofpoint TA453 July2021","url":"https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453"}]},{"technique_id":"T1585.001","description":"Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.","sources":[{"source":"ClearSky Kittens Back 3 August 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"}]},{"technique_id":"T1585.002","description":"Magic Hound has established email accounts using fake personas for spearphishing operations.","sources":[{"source":"Proofpoint TA453 March 2021","url":"https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential"},{"source":"IBM ITG18 2020","url":"https://securityintelligence.com/posts/new-research-exposes-iranian-threat-group-operations/"}]},{"technique_id":"T1586.002","description":"Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.","sources":[{"source":"IBM ITG18 2020","url":"https://securityintelligence.com/posts/new-research-exposes-iranian-threat-group-operations/"}]},{"technique_id":"T1588.002","description":"Magic Hound has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.","sources":[{"source":"Check Point Rocket Kitten","url":"https://blog.checkpoint.com/wp-content/uploads/2015/11/rocket-kitten-report.pdf"},{"source":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"},{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1589","description":"Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.","sources":[{"source":"Proofpoint TA453 July2021","url":"https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453"}]},{"technique_id":"T1589.001","description":"Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites. Magic Hound has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.","sources":[{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"},{"source":"IBM ITG18 2020","url":"https://securityintelligence.com/posts/new-research-exposes-iranian-threat-group-operations/"}]},{"technique_id":"T1589.002","description":"Magic Hound has identified high-value email accounts in academia, journalism, NGO's, foreign policy, and national security for targeting.","sources":[{"source":"Google Iran Threats October 2021","url":"https://blog.google/threat-analysis-group/countering-threats-iran/"},{"source":"Proofpoint TA453 July2021","url":"https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453"}]},{"technique_id":"T1590.005","description":"Magic Hound has captured the IP addresses of visitors to their phishing sites.","sources":[{"source":"Google Iran Threats October 2021","url":"https://blog.google/threat-analysis-group/countering-threats-iran/"}]},{"technique_id":"T1591.001","description":"Magic Hound has collected location information from visitors to their phishing sites.","sources":[{"source":"Google Iran Threats October 2021","url":"https://blog.google/threat-analysis-group/countering-threats-iran/"}]},{"technique_id":"T1592.002","description":"Magic Hound has captured the user-agent strings from visitors to their phishing sites.","sources":[{"source":"Google Iran Threats October 2021","url":"https://blog.google/threat-analysis-group/countering-threats-iran/"}]},{"technique_id":"T1595.002","description":"Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.","sources":[{"source":"Check Point APT35 CharmPower January 2022","url":"https://research.checkpoint.com/2022/apt35-exploits-log4j-vulnerability-to-distribute-new-modular-powershell-toolkit/"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1598.003","description":"Magic Hound has used SMS and email messages with links designed to steal credentials or track victims.","sources":[{"source":"Google Iran Threats October 2021","url":"https://blog.google/threat-analysis-group/countering-threats-iran/"},{"source":"Certfa Charming Kitten January 2021","url":"https://blog.certfa.com/posts/charming-kitten-christmas-gift/"},{"source":"ClearSky Kittens Back 3 August 2020","url":"https://www.clearskysec.com/wp-content/uploads/2020/08/The-Kittens-are-Back-in-Town-3.pdf"},{"source":"Proofpoint TA453 July2021","url":"https://www.proofpoint.com/us/blog/threat-insight/operation-spoofedscholars-conversation-ta453"},{"source":"Proofpoint TA453 March 2021","url":"https://www.proofpoint.com/us/blog/threat-insight/badblood-ta453-targets-us-and-israeli-medical-research-personnel-credential"},{"source":"Microsoft Iranian Threat Actor Trends November 2021","url":"https://www.microsoft.com/en-us/security/blog/2021/11/16/evolving-trends-in-iranian-threat-actor-activity-mstic-presentation-at-cyberwarcon-2021"}]},{"technique_id":"T1685","description":"Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.","sources":[{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]},{"technique_id":"T1685.001","description":"Magic Hound has executed scripts to disable the event log service.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"}]},{"technique_id":"T1686.003","description":"Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - \"netsh\" advfirewall firewall add rule name=\"Terminal Server\" dir=in action=allow protocol=TCP localport=3389.","sources":[{"source":"DFIR Phosphorus November 2021","url":"https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/"},{"source":"DFIR Report APT35 ProxyShell March 2022","url":"https://thedfirreport.com/2022/03/21/apt35-automates-initial-access-using-proxyshell"}]}]},{"id":"G1026","name":"Malteiro","procedures":[{"technique_id":"T1027.013","description":"Malteiro has used scripts encoded in Base64 certificates to distribute malware to victims.","sources":[{"source":"SCILabs Malteiro Threat Overlap 2023","url":"https://blog.scilabs.mx/en/ursa-mispadu-overlap-analysis-with-other-threats/"}]},{"technique_id":"T1055.001","description":"Malteiro has injected Mispadu’s DLL into a process.","sources":[{"source":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"technique_id":"T1059.005","description":"Malteiro has utilized a dropper containing malicious VBS scripts.","sources":[{"source":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"technique_id":"T1082","description":"Malteiro collects the machine information, system architecture, the OS version, computer name, and Windows product name.","sources":[{"source":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"technique_id":"T1140","description":"Malteiro has the ability to deobfuscate downloaded files prior to execution.","sources":[{"source":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"technique_id":"T1204.002","description":"Malteiro has relied on users to execute .zip file attachments containing malicious URLs.","sources":[{"source":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"technique_id":"T1518.001","description":"Malteiro collects the installed antivirus on the victim machine.","sources":[{"source":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"technique_id":"T1555","description":"Malteiro has obtained credentials from mail clients via NirSoft MailPassView.","sources":[{"source":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"technique_id":"T1555.003","description":"Malteiro has stolen credentials stored in the victim’s browsers via software tool NirSoft WebBrowserPassView.","sources":[{"source":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"technique_id":"T1566.001","description":"Malteiro has sent spearphishing emails containing malicious .zip files.","sources":[{"source":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"technique_id":"T1614.001","description":"Malteiro will terminate Mispadu's infection process if the language of the victim machine is not Spanish or Portuguese.","sources":[{"source":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]},{"technique_id":"T1657","description":"Malteiro targets organizations in a wide variety of sectors via the use of Mispadu banking trojan with the goal of financial theft.","sources":[{"source":"SCILabs Malteiro 2021","url":"https://blog.scilabs.mx/en/cyber-threat-profile-malteiro/"}]}]},{"id":"G1051","name":"Medusa Group","procedures":[{"technique_id":"T1003.001","description":"Medusa Group has leveraged Mimikatz to dump LSASS to harvest credentials.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1003.003","description":"Medusa Group has accessed the ntds.dit file to engage in credential dumping.","sources":[{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1016","description":"Medusa Group has obtained host network details utilizing the command cmd.exe /c ipconfig /all.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1018","description":"Medusa Group has used PDQ Inventory to get an inventory of the endpoints on the network.","sources":[{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1021.001","description":"Medusa Group has used RDP to conduct lateral movement and exfiltrate data. Medusa Group has also utilized the Windows executable mstsc.exe for RDP activities through the command mstsc.exe /v:{hostname/ip}.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1027.002","description":"Medusa Group has packed the code of dropped kernel drivers using the packer ASM Guard.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"}]},{"technique_id":"T1027.010","description":"Medusa Group has obfuscated PowerShell scripts with Base64 encoding. Medusa Group has also obfuscated the code of dropped kernel drivers using a software known as Safengine Shielden which randomized the code through code mutations and then leveraged an embedded virtual machine interpreter to execute the code.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1033","description":"Medusa Group has utilized PsExec to execute quser to discover the user session information.","sources":[{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1046","description":"Medusa Group has the capability to use living off the land (LOTL) binaries to perform network enumeration. Medusa Group has also utilized the publicly available scanning tool SoftPerfect Network Scanner (netscan.exe) to discover device hostnames and network services.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1047","description":"Medusa Group has utilized Windows Management Instrumentation to query system information.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Intel471 Medusa Ransomware May 2025","url":"https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware"}]},{"technique_id":"T1057","description":"Medusa Group has utilized a hard-coded security tool process list that identifies and terminates using an undocumented IOCTL code 0x222094.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"}]},{"technique_id":"T1059.001","description":"Medusa Group has leveraged PowerShell for execution and defense evasion. Medusa Group has also utilized PowerShell to execute a bitsadmin transfer from file hosting site.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"Check Point Medusa Ransomware April 2025","url":"https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/medusa-ransomware-group/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Intel471 Medusa Ransomware May 2025","url":"https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware"}]},{"technique_id":"T1059.003","description":"Medusa Group has used Windows Command Prompt to control and execute commands on the system to include ingress, network, and filesystem enumeration activities.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1069.002","description":"Medusa Group has utilized the net group command to query domain groups within the victim environment.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1070.003","description":"Medusa Group has cleared command history by running the PowerShell command Remove-Item (Get-PSReadlineOption).HistorySavePath.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1070.004","description":"Medusa Group has deleted previously installed tools.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1071.001","description":"Medusa Group has communicated through reverse or bind shells over port 443 (HTTPS).","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1072","description":"Medusa Group has utilized software deployment and management solutions to deploy their encryption payload to include BigFix and PDQ Deploy.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1078","description":"Medusa Group has utilized compromised legitimate local and domain accounts within the victim environment to facilitate remote access and lateral movement sometimes in combination with PsExec.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1082","description":"Medusa Group has leveraged cmd.exe to identify system info cmd.exe /c systeminfo.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1083","description":"Medusa Group has searched for files within the victim environment for encryption and exfiltration. Medusa Group has also identified files associated with remote management services.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"technique_id":"T1087.001","description":"Medusa Group has leveraged net user for account discovery.","sources":[{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1090.003","description":"Medusa Group has used TOR nodes for communications.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"Check Point Medusa Ransomware April 2025","url":"https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/medusa-ransomware-group/"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1105","description":"Medusa Group has leveraged certutil, PowerShell, and Windows Command to download additional tools to include RMM services. Medusa Group has also engaged in “Bring Your Own Vulnerable Driver” (BYOVD) and downloaded vulnerable or signed drivers to the victim environment to disable security tools.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1106","description":"Medusa Group has leveraged Windows Native API functions to execute payloads.","sources":[{"source":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"technique_id":"T1112","description":"Medusa Group has modified Registry keys to elevate privileges, maintain persistence and allow remote access.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1135","description":"Medusa Group has identified network shares using cmd.exe /c net share.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1136.002","description":"Medusa Group has created a domain account within the victim environment.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1190","description":"Medusa Group has leveraged public facing vulnerabilities in their campaigns against victim organizations to gain initial access. Medusa Group has also utilized CVE-2024-1709 in ScreenConnect, and CVE-2023-48788 in Fortinet EMS for initial access to victim environments.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1218.014","description":"Medusa Group has leveraged Microsoft Management Console (MMC) to facilitate lateral movement and to interact locally or remotely with victim devices using the command mmc.exe compmgmt.msc /computer:{hostname/ip}.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1219","description":"Medusa Group has leveraged Remote Access Software for lateral movement and data exfiltration. Medusa Group has also been known to utilize Remote Access Software such as AnyDesk, Atera, ConnectWise, eHorus, N-Able, PDQ Deploy, PDQ Inventory, SimpleHelp and Splashtop.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"technique_id":"T1486","description":"Medusa Group has encrypted files using AES-256 encryption which then appends the file extension “.medusa” to encrypted files and leaves a ransomware note named “!READ_ME_MEDUSA!!!.txt.”","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"technique_id":"T1489","description":"Medusa Group has terminated services related to backups, security, databases, communication, filesharing and websites.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"technique_id":"T1490","description":"Medusa Group has deleted recovery files such as shadow copies using vssadmin.exe.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"technique_id":"T1505.003","description":"Medusa Group has utilized webshells to an exploited Microsoft Exchange Server.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"}]},{"technique_id":"T1518.001","description":"Medusa Group has detected security solutions for termination or deletion within the victim device using hard-coded lists of strings containing security product executables.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"}]},{"technique_id":"T1529","description":"Medusa Group has manually turned off and encrypted virtual machines.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1543.003","description":"Medusa Group has used vulnerable or signed drivers to modify security solutions on victim devices.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1548.002","description":"Medusa Group has attempted to bypass UAC using Component Object Model (COM) interface.","sources":[{"source":"Intel471 Medusa Ransomware May 2025","url":"https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware"}]},{"technique_id":"T1553.002","description":"Medusa Group has utilized vulnerable or signed drivers to kill or delete services associated with endpoint detection and response (EDR) tools.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1559.001","description":"Medusa Group has leveraged Component Object Model (COM) to bypass UAC.","sources":[{"source":"Intel471 Medusa Ransomware May 2025","url":"https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware"}]},{"technique_id":"T1564.003","description":"Medusa Group has utilized the ShowWindow API function to hide the current window.","sources":[{"source":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"technique_id":"T1567.002","description":"Medusa Group has utilized Rclone to exfiltrate data from victim environments to cloud storage.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1569.002","description":"Medusa Group has utilized PsExec to execute scripts and commands within victim environments. Medusa Group has also used the Windows service RoboCopy to search and copy data for exfiltration.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1570","description":"Medusa Group has utilized legitimate software services such as PDQ Deploy to transfer malicious binaries and tools to other victimized hosts within the target environment.","sources":[{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1573.002","description":"Medusa Group has used HTTPS for command and control.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1583.006","description":"Medusa Group has utilized a file hosting service named filemail[.]com to host a zip file that contained malicious payloads that facilitated follow-on actions.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"}]},{"technique_id":"T1585.001","description":"Medusa Group has created social media accounts including Telegram and X to publicize their activities.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"Check Point Medusa Ransomware April 2025","url":"https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/medusa-ransomware-group/"}]},{"technique_id":"T1585.002","description":"Medusa Group has created email accounts used in ransomware negotiations.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1588.002","description":"Medusa Group has obtained and leveraged numerous RMM services, along with publicly available tools used for scanning. Medusa Group has utilized tools such as Advanced IP Scanner and SoftPerfect Network scanner for user, system and network discovery. Medusa Group has also acquired tools for command and control and defense evasion which include tunneling tools Ligolo and Cloudflared.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1608.002","description":"Medusa Group has utilized a file hosting service called filemail[.]com to host a zip file that contained a RMM service such as ConnectWise.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"}]},{"technique_id":"T1650","description":"Medusa Group has purchased user credentials and other sensitive data from Initial Access Brokers (IABs).","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"Check Point Medusa Ransomware April 2025","url":"https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/medusa-ransomware-group/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Intel471 Medusa Ransomware May 2025","url":"https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware"}]},{"technique_id":"T1652","description":"Medusa Group has queried drivers on the victim device through the command driverquery.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1657","description":"Medusa Group has stolen and encrypted victims' data in order to extort victims into paying a ransom.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"Check Point Medusa Ransomware April 2025","url":"https://www.checkpoint.com/cyber-hub/threat-prevention/ransomware/medusa-ransomware-group/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Intel471 Medusa Ransomware May 2025","url":"https://www.intel471.com/blog/threat-hunting-case-study-medusa-ransomware"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"},{"source":"Security Scorecard Medusa Ransomware January 2024","url":"https://securityscorecard.com/wp-content/uploads/2024/01/deep-dive-into-medusa-ransomware.pdf"}]},{"technique_id":"T1685","description":"Medusa Group has terminated antivirus services utilizing the gaze.exe executable and utilizing psexec.exe. Medusa Group has also leveraged I/O control codes (IOCTLs) for terminating and deleting processes of identified security tools.","sources":[{"source":"Palo Alto Unit 42 Medusa Group Medusa Ransomware January 2024","url":"https://unit42.paloaltonetworks.com/medusa-ransomware-escalation-new-leak-site/"},{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"},{"source":"Broadcom Medusa Ransomware Medusa Group March 2025","url":"https://www.security.com/threat-intelligence/medusa-ransomware-attacks"}]},{"technique_id":"T1686","description":"Medusa Group has utilized PsExec to execute batch scripts that modify firewall settings. Medusa Group has also enabled and modified firewall rules to allow for RDP connections for lateral movement and device interactions.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]},{"technique_id":"T1690","description":"Medusa Group has removed PowerShell command history through the use of the PSReadLine module by running the PowerShell command Remove-Item (Get-PSReadlineOption).HistorySavePath.","sources":[{"source":"CISA Medusa Group Medusa Ransomware March 2025","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa25-071a"}]}]},{"id":"G0045","name":"menuPass","procedures":[{"technique_id":"T1003.002","description":"menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.","sources":[{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source":"Github AD-Pentest-Script","url":"https://github.com/Twi1ight/AD-Pentest-Script/blob/master/wmiexec.vbs"}]},{"technique_id":"T1003.003","description":"menuPass has used Ntdsutil to dump credentials.","sources":[{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"technique_id":"T1003.004","description":"menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.","sources":[{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source":"Github AD-Pentest-Script","url":"https://github.com/Twi1ight/AD-Pentest-Script/blob/master/wmiexec.vbs"}]},{"technique_id":"T1005","description":"menuPass has collected various files from the compromised computers.","sources":[{"source":"DOJ APT10 Dec 2018","url":"https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion"},{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"technique_id":"T1016","description":"menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.","sources":[{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"technique_id":"T1018","description":"menuPass uses scripts to enumerate IP ranges on the victim network. menuPass has also issued the command net view /domain to a PlugX implant to gather information about remote systems on the network.","sources":[{"source":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"technique_id":"T1021.001","description":"menuPass has used RDP connections to move across the victim network.","sources":[{"source":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"},{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1021.004","description":"menuPass has used Putty Secure Copy Client (PSCP) to transfer data.","sources":[{"source":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"}]},{"technique_id":"T1027.013","description":"menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.","sources":[{"source":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"},{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"technique_id":"T1036","description":"menuPass has used esentutl to change file extensions to their true type that were masquerading as .txt files.","sources":[{"source":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}]},{"technique_id":"T1036.003","description":"menuPass has renamed certutil and moved it to a different location on the system to avoid detection based on use of the tool.","sources":[{"source":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}]},{"technique_id":"T1036.005","description":"menuPass has been seen changing malicious files to appear legitimate.","sources":[{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1039","description":"menuPass has collected data from remote systems by mounting network shares with net use and using Robocopy to transfer data.","sources":[{"source":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"}]},{"technique_id":"T1046","description":"menuPass has used tcping.exe, similar to Ping, to probe port status on systems of interest.","sources":[{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"technique_id":"T1047","description":"menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.","sources":[{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"},{"source":"Github AD-Pentest-Script","url":"https://github.com/Twi1ight/AD-Pentest-Script/blob/master/wmiexec.vbs"}]},{"technique_id":"T1049","description":"menuPass has used net use to conduct connectivity checks to machines.","sources":[{"source":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"}]},{"technique_id":"T1053.005","description":"menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.","sources":[{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"technique_id":"T1055.012","description":"menuPass has used process hollowing in iexplore.exe to load the RedLeaves implant.","sources":[]},{"technique_id":"T1056.001","description":"menuPass has used key loggers to steal usernames and passwords.","sources":[{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1059.001","description":"menuPass uses PowerSploit to inject shellcode into PowerShell.","sources":[{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"technique_id":"T1059.003","description":"menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands. menuPass has used malicious macros embedded inside Office documents to execute files.","sources":[{"source":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"},{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"},{"source":"Github AD-Pentest-Script","url":"https://github.com/Twi1ight/AD-Pentest-Script/blob/master/wmiexec.vbs"}]},{"technique_id":"T1070.003","description":"menuPass has used Wevtutil to remove PowerShell execution logs.","sources":[{"source":"Securelist APT10 March 2021","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"technique_id":"T1070.004","description":"A menuPass macro deletes files after it has decoded and decompressed them.","sources":[{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1074.001","description":"menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.","sources":[{"source":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"}]},{"technique_id":"T1074.002","description":"menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.","sources":[{"source":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"},{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"technique_id":"T1078","description":"menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.","sources":[{"source":"Securelist APT10 March 2021","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"},{"source":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"},{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"},{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1083","description":"menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.","sources":[{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"technique_id":"T1087.002","description":"menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.","sources":[{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"technique_id":"T1090.002","description":"menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.","sources":[{"source":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}]},{"technique_id":"T1105","description":"menuPass has installed updates and new malware on victims.","sources":[{"source":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"},{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1106","description":"menuPass has used native APIs including GetModuleFileName, lstrcat, CreateFile, and ReadFile.","sources":[{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"technique_id":"T1119","description":"menuPass has used the Csvde tool to collect Active Directory files and data.","sources":[{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"technique_id":"T1140","description":"menuPass has used certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used certutil -decode to decode files on the victim’s machine when dropping UPPERCUT.","sources":[{"source":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"}]},{"technique_id":"T1190","description":"menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.","sources":[{"source":"Securelist APT10 March 2021","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"technique_id":"T1199","description":"menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.","sources":[{"source":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"},{"source":"DOJ APT10 Dec 2018","url":"https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion"},{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1204.002","description":"menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.","sources":[{"source":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"},{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1210","description":"menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).","sources":[{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"technique_id":"T1218.004","description":"menuPass has used InstallUtil.exe to execute malicious software.","sources":[{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]},{"technique_id":"T1553.002","description":"menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.","sources":[{"source":"Securelist APT10 March 2021","url":"https://securelist.com/apt10-sophisticated-multi-layered-loader-ecipekac-discovered-in-a41apt-campaign/101519/"}]},{"technique_id":"T1560","description":"menuPass has encrypted files and information before exfiltration.","sources":[{"source":"DOJ APT10 Dec 2018","url":"https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion"},{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1560.001","description":"menuPass has compressed files before exfiltration using TAR and RAR.","sources":[{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"},{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"technique_id":"T1566.001","description":"menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.","sources":[{"source":"FireEye APT10 April 2017","url":"https://www.fireeye.com/blog/threat-research/2017/04/apt10_menupass_grou.html"},{"source":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"},{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1568.001","description":"menuPass has used dynamic DNS service providers to host malicious domains.","sources":[{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1574.001","description":"menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as UPPERCUT. menuPass has also used DLL search order hijacking.","sources":[{"source":"FireEye APT10 Sept 2018","url":"https://www.fireeye.com/blog/threat-research/2018/09/apt10-targeting-japanese-corporations-using-updated-ttps.html"},{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"},{"source":"PWC Cloud Hopper April 2017","url":"https://web.archive.org/web/20220224041316/https:/www.pwc.co.uk/cyber-security/pdf/cloud-hopper-report-final-v4.pdf"},{"source":"Symantec Cicada November 2020","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/cicada-apt10-japan-espionage"}]},{"technique_id":"T1583.001","description":"menuPass has registered malicious domains for use in intrusion campaigns.","sources":[{"source":"DOJ APT10 Dec 2018","url":"https://www.justice.gov/opa/pr/two-chinese-hackers-associated-ministry-state-security-charged-global-computer-intrusion"},{"source":"District Court of NY APT10 Indictment December 2018","url":"https://www.justice.gov/opa/page/file/1122671/download"}]},{"technique_id":"T1588.002","description":"menuPass has used and modified open-source tools like Impacket, Mimikatz, and pwdump.","sources":[{"source":"PWC Cloud Hopper Technical Annex April 2017","url":"https://www.pwc.co.uk/cyber-security/pdf/pwc-uk-operation-cloud-hopper-technical-annex-april-2017.pdf"}]}]},{"id":"G1013","name":"Metador","procedures":[{"technique_id":"T1027.013","description":"Metador has encrypted their payloads.","sources":[{"source":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"technique_id":"T1059.003","description":"Metador has used the Windows command line to execute commands.","sources":[{"source":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"technique_id":"T1070.004","description":"Metador has quickly deleted cbd.exe from a compromised host following the successful deployment of their malware.","sources":[{"source":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"technique_id":"T1071.001","description":"Metador has used HTTP for C2.","sources":[{"source":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"technique_id":"T1095","description":"Metador has used TCP for C2.","sources":[{"source":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"technique_id":"T1105","description":"Metador has downloaded tools and malware onto a compromised system.","sources":[{"source":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"technique_id":"T1546.003","description":"Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as cdb.exe.","sources":[{"source":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"technique_id":"T1588.001","description":"Metador has used unique malware in their operations, including metaMain and Mafalda.","sources":[{"source":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]},{"technique_id":"T1588.002","description":"Metador has used Microsoft's Console Debugger in some of their operations.","sources":[{"source":"SentinelLabs Metador Sept 2022","url":"https://assets.sentinelone.com/sentinellabs22/metador#page=1"}]}]},{"id":"G1054","name":"MirrorFace","procedures":[{"technique_id":"T1003.001","description":"MirrorFace has dumped LSASS memory for credential access.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"technique_id":"T1003.002","description":"MirrorFace has used vssadmin to copy registry hives including SAM.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1003.003","description":"MirrorFace has dumped NTDS.dit through volume shadow copies.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1005","description":"MirrorFace gathered data and files of interest from victim's systems.","sources":[{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1007","description":"MirrorFace has used Tasklist for discovery post compromise.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"technique_id":"T1016","description":"MirrorFace has used ipconfig for reconnaissance.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"technique_id":"T1018","description":"MirrorFace has used Ping for system discovery.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"technique_id":"T1021.001","description":"MirrorFace has used RDP to exfiltrate files of interest.","sources":[{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1021.002","description":"MirrorFace has used SMB to copy malware between systems in compromised environments.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1027.013","description":"MirrorFace has used Base64 encoded shellcode in infection chains to evade detection.","sources":[{"source":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"technique_id":"T1033","description":"MirrorFace has used Windows native tools to enumerate user information.","sources":[{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1036.008","description":"MirrorFace has crafted malware payloads to appear as Privacy-Enhanced Mail (PEM) files.","sources":[{"source":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"technique_id":"T1047","description":"MirrorFace has leveraged WMIC on targeted systems post compromise.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"technique_id":"T1048.002","description":"MirrorFace has used Secure File Transfer Protocol (SFTP) for file exfiltration.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"technique_id":"T1057","description":"MirrorFace has used Tasklist on compromised hosts for discovery.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"technique_id":"T1059.003","description":"MirrorFace has used cmd.exe for malware execution, file discovery, and manual file manipulation.","sources":[{"source":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"},{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1059.005","description":"MirrorFace has used remote templates with VBA code in malware infection chains.","sources":[{"source":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"technique_id":"T1070.004","description":"MirrorFace has deleted directories containing malware and archives with files collected from the victim environment.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"},{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1071.002","description":"MirrorFace has used the the PuTTY suite Secure Copy Protocol (SCP) client for file transfer.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}]},{"technique_id":"T1074.002","description":"MirrorFace has gathered data and files of interest on a single victim machine.","sources":[{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1082","description":"MirrorFace has employed malicious macros and native Windows tools such as csvde.exe, nltest.exe and quser.exe for discovery.","sources":[{"source":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"},{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1083","description":"MirrorFace has run commands to check the content of folders on compromised hosts and has specifically targeted files with .doc, .ppt, .xls, .jtd, .eml, .xps, and .pdf extensions.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1087.002","description":"MirrorFace has used native Windows tools to obtain domain user information.","sources":[{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1090","description":"MirrorFace has used the GO Simple Tunnel (GOST) proxy tool.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"technique_id":"T1114.001","description":"MirrorFace has exfiltrated stored emails from compromised hosts.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}]},{"technique_id":"T1190","description":"MirrorFace has exploited vulnerabilities in Fortigate and Array AG devices for initial access.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"technique_id":"T1204.002","description":"MirrorFace has lured victims into opening crafted Word, Excel, and SFX files for execution.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"},{"source":"Kaspersky LODEINFO OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"},{"source":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"technique_id":"T1221","description":"MirrorFace has used remote template injection to retrieve malicious payloads from the C2.","sources":[{"source":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"technique_id":"T1482","description":"MirrorFace has run nltest.exe /domain_trusts on compromised systems to discover domain relationships.","sources":[{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1553.002","description":"MirrorFace has abused a known Microsoft digital signature verification issues to append encrypted data to digital signatures that still appear to be validly signed.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}]},{"technique_id":"T1556.002","description":"MirrorFace has used a tool named MRSAStealer as a password filter to collect credentials on password changes.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}]},{"technique_id":"T1560.001","description":"MirrorFace has used rar.exe and the Makecab utility to archive files of interest prior to exfiltration.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1566.001","description":"MirrorFace has sent spearphishing emails with malicious attachments to deliver malware payloads.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source":"Kaspersky LODEINFO OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"},{"source":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"technique_id":"T1566.002","description":"MirrorFace has embedded OneDrive URLs in emails leading to malicious file installation.","sources":[{"source":"Trend Micro Earth Kasha Updates APR 2025","url":"https://www.trendmicro.com/en_us/research/25/d/earth-kasha-updates-ttps.html"}]},{"technique_id":"T1574.001","description":"MirrorFace has used legitimate EXE files to load malicious DLLs via sideloading.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source":"Kaspersky LODEINFO OCT 2022","url":"https://securelist.com/apt10-tracking-down-lodeinfo-2022-part-i/107742/"},{"source":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"},{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1587.001","description":"MirrorFace has created and continued to develop custom strains of malware including LODEINFO.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}]},{"technique_id":"T1588.002","description":"MirrorFace has used tools including the Secure Copy Protocol (SCP) client from PuTTY and Cobalt Strike.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"},{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"},{"source":"Trend Micro Earth Kasha NOV 2024","url":"https://www.trendmicro.com/en_us/research/24/k/lodeinfo-campaign-of-earth-kasha.html"}]},{"technique_id":"T1591","description":"MirrorFace has placed specific content in phishing emails to target members of particular political parties.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}]},{"technique_id":"T1614.001","description":"MirrorFace has deployed shellcode to check for Japanese Microsoft Office settings.","sources":[{"source":"ITOCHU LODEINFO JAN 2024","url":"https://blog-en.itochuci.co.jp/entry/2024/01/24/134100"}]},{"technique_id":"T1684.001","description":"MirrorFace has sent targeted emails purporting to be from a Japanese political party’s PR department.","sources":[{"source":"ESET MirrorFace DEC 2022","url":"https://www.welivesecurity.com/2022/12/14/unmasking-mirrorface-operation-liberalface-targeting-japanese-political-entities/"}]},{"technique_id":"T1685","description":"MirrorFace has disabled Windows Defender in compromised environments.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"technique_id":"T1685.005","description":"MirrorFace has deleted Windows event logs.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]},{"technique_id":"T1686.003","description":"MirrorFace can modify the system firewall to allow communication to certain ports.","sources":[{"source":"JPCERT MirrorFace JUL 2024","url":"https://blogs.jpcert.or.jp/en/2024/07/mirrorface-attack-against-japanese-organisations.html"}]}]},{"id":"G0002","name":"Moafee","procedures":[{"technique_id":"T1027.001","description":"Moafee has been known to employ binary padding.","sources":[{"source":"Haq 2014","url":"https://www.fireeye.com/blog/threat-research/2014/09/the-path-to-mass-producing-cyber-attacks.html"}]}]},{"id":"G0103","name":"Mofang","procedures":[{"technique_id":"T1027.013","description":"Mofang has encrypted payloads before they are downloaded to victims.","sources":[{"source":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"technique_id":"T1027.015","description":"Mofang has compressed the ShimRat executable within malicious email attachments.","sources":[{"source":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"technique_id":"T1204.001","description":"Mofang's spearphishing emails required a user to click the link to connect to a compromised website.","sources":[{"source":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"technique_id":"T1204.002","description":"Mofang's malicious spearphishing attachments required a user to open the file after receiving.","sources":[{"source":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"technique_id":"T1566.001","description":"Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.","sources":[{"source":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]},{"technique_id":"T1566.002","description":"Mofang delivered spearphishing emails with malicious links included.","sources":[{"source":"FOX-IT May 2016 Mofang","url":"https://foxitsecurity.files.wordpress.com/2016/06/fox-it_mofang_threatreport_tlp-white.pdf"}]}]},{"id":"G0021","name":"Molerats","procedures":[{"technique_id":"T1027.015","description":"Molerats has delivered compressed executables within ZIP files to victims.","sources":[{"source":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}]},{"technique_id":"T1053.005","description":"Molerats has created scheduled tasks to persistently run VBScripts.","sources":[{"source":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}]},{"technique_id":"T1057","description":"Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.","sources":[{"source":"DustySky","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"}]},{"technique_id":"T1059.001","description":"Molerats used PowerShell implants on target machines.","sources":[{"source":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}]},{"technique_id":"T1059.005","description":"Molerats used various implants, including those built with VBScript, on target machines.","sources":[{"source":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"},{"source":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}]},{"technique_id":"T1059.007","description":"Molerats used various implants, including those built with JS, on target machines.","sources":[{"source":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}]},{"technique_id":"T1105","description":"Molerats used executables to download malicious files from different sources.","sources":[{"source":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"},{"source":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}]},{"technique_id":"T1140","description":"Molerats decompresses ZIP files once on the victim machine.","sources":[{"source":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}]},{"technique_id":"T1204.001","description":"Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.","sources":[{"source":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"},{"source":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}]},{"technique_id":"T1204.002","description":"Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.","sources":[{"source":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"},{"source":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"},{"source":"Cybereason Molerats Dec 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"}]},{"technique_id":"T1218.007","description":"Molerats has used msiexec.exe to execute an MSI payload.","sources":[{"source":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"}]},{"technique_id":"T1547.001","description":"Molerats saved malicious files within the AppData and Startup folders to maintain persistence.","sources":[{"source":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}]},{"technique_id":"T1553.002","description":"Molerats has used forged Microsoft code-signing certificates on malware.","sources":[{"source":"FireEye Operation Molerats","url":"https://web.archive.org/web/20201031075438/https://www.fireeye.com/blog/threat-research/2013/08/operation-molerats-middle-east-cyber-attacks-using-poison-ivy.html"}]},{"technique_id":"T1555.003","description":"Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.","sources":[{"source":"DustySky","url":"https://www.clearskysec.com/wp-content/uploads/2016/01/Operation%20DustySky_TLP_WHITE.pdf"}]},{"technique_id":"T1566.001","description":"Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.","sources":[{"source":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"},{"source":"Unit42 Molerat Mar 2020","url":"https://unit42.paloaltonetworks.com/molerats-delivers-spark-backdoor/"},{"source":"Cybereason Molerats Dec 2020","url":"https://www.cybereason.com/hubfs/dam/collateral/reports/Molerats-in-the-Cloud-New-Malware-Arsenal-Abuses-Cloud-Platforms-in-Middle-East-Espionage-Campaign.pdf"}]},{"technique_id":"T1566.002","description":"Molerats has sent phishing emails with malicious links included.","sources":[{"source":"Kaspersky MoleRATs April 2019","url":"https://securelist.com/gaza-cybergang-group1-operation-sneakypastes/90068/"}]}]},{"id":"G1036","name":"Moonstone Sleet","procedures":[{"technique_id":"T1003.001","description":"Moonstone Sleet retrieved credentials from LSASS memory.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1016","description":"Moonstone Sleet has gathered information on victim network configuration.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1027","description":"Moonstone Sleet delivers encrypted payloads in pieces that are then combined together to form a new portable executable (PE) file during installation.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1027.009","description":"Moonstone Sleet embedded payloads in trojanized software for follow-on execution.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1027.013","description":"Moonstone Sleet has used encrypted payloads within files for follow-on execution and defense evasion.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1033","description":"Moonstone Sleet deployed various malware such as YouieLoader that can perform system user discovery actions.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1053.005","description":"Moonstone Sleet used scheduled tasks for program execution during initial access to victim machines.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1071.001","description":"Moonstone Sleet used curl to connect to adversary-controlled infrastructure and retrieve additional payloads.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1082","description":"Moonstone Sleet has gathered information on victim systems.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1105","description":"Moonstone Sleet retrieved a final stage payload from command and control infrastructure during initial installation on victim systems.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1140","description":"Moonstone Sleet delivered payloads using multiple rounds of obfuscation and encoding to evade defenses and analysis.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1195.002","description":"Moonstone Sleet has distributed a trojanized version of PuTTY software for initial access to victims.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1204.002","description":"Moonstone Sleet relied on users interacting with malicious files, such as a trojanized PuTTY installer, for initial execution.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1217","description":"Moonstone Sleet deployed malware such as YouieLoader capable of capturing victim system browser information.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1486","description":"Moonstone Sleet has deployed ransomware in victim environments.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1547.001","description":"Moonstone Sleet used registry run keys for process execution during initial victim infection.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1566.001","description":"Moonstone Sleet delivered various payloads to victims as spearphishing attachments.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1566.003","description":"Moonstone Sleet has used social media services to spear phish victims to deliver trojainized software.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1569.002","description":"Moonstone Sleet used intermediate loader malware such as YouieLoader and SplitLoader that create malicious services.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1583.001","description":"Moonstone Sleet registered domains to develop effective personas for fake companies used in phishing activity.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1583.003","description":"Moonstone Sleet registered virtual private servers to host payloads for download.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1585.001","description":"Moonstone Sleet has created social media accounts to interact with victims.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1585.002","description":"Moonstone Sleet has created email accounts to interact with victims, including for phishing purposes.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1587","description":"Moonstone Sleet developed malicious npm packages for delivery to or retrieval by victims.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1587.001","description":"Moonstone Sleet has developed custom malware, including a malware delivery mechanism masquerading as a legitimate game.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1589.002","description":"Moonstone Sleet gathered victim email address information for follow-on phishing activity.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1591","description":"Moonstone Sleet has gathered information on victim organizations through email and social media interaction.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1598","description":"Moonstone Sleet has interacted with victims to gather information via email.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1598.003","description":"Moonstone Sleet used spearphishing messages containing items such as tracking pixels to determine if users interacted with malicious messages.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]},{"technique_id":"T1608.001","description":"Moonstone Sleet staged malicious capabilities online for follow-on download by victims or malware.","sources":[{"source":"Microsoft Moonstone Sleet 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/28/moonstone-sleet-emerges-as-new-north-korean-threat-actor-with-new-bag-of-tricks/"}]}]},{"id":"G1009","name":"Moses Staff","procedures":[{"technique_id":"T1016","description":"Moses Staff has collected the domain name of a compromised network.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"technique_id":"T1021.002","description":"Moses Staff has used batch scripts that can enable SMB on a compromised host.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"technique_id":"T1027.013","description":"Moses Staff has used obfuscated web shells in their operations.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"technique_id":"T1082","description":"Moses Staff collected information about the infected host, including the machine names and OS architecture.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"technique_id":"T1087.001","description":"Moses Staff has collected the administrator username from a compromised host.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"technique_id":"T1105","description":"Moses Staff has downloaded and installed web shells to following path C:\\inetpub\\wwwroot\\aspnet_client\\system_web\\IISpool.aspx.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"technique_id":"T1190","description":"Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"technique_id":"T1505.003","description":"Moses Staff has dropped a web shell onto a compromised system.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"technique_id":"T1553.002","description":"Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"technique_id":"T1587.001","description":"Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"technique_id":"T1588.002","description":"Moses Staff has used the commercial tool DiskCryptor.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]},{"technique_id":"T1686.003","description":"Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.","sources":[{"source":"Checkpoint MosesStaff Nov 2021","url":"https://research.checkpoint.com/2021/mosesstaff-targeting-israeli-companies/"}]}]},{"id":"G1019","name":"MoustachedBouncer","procedures":[{"technique_id":"T1027.002","description":"MoustachedBouncer has used malware plugins packed with Themida.","sources":[{"source":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"technique_id":"T1059.001","description":"MoustachedBouncer has used plugins to execute PowerShell scripts.","sources":[{"source":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"technique_id":"T1059.007","description":"MoustachedBouncer has used JavaScript to deliver malware hosted on HTML pages.","sources":[{"source":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"technique_id":"T1068","description":"MoustachedBouncer has exploited CVE-2021-1732 to execute malware components with elevated rights.","sources":[{"source":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"technique_id":"T1074.002","description":"MoustachedBouncer has used plugins to save captured screenshots to .\\AActdata\\ on an SMB share.","sources":[{"source":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"technique_id":"T1090","description":"MoustachedBouncer has used a reverse proxy tool similar to the GitHub repository revsocks.","sources":[{"source":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"technique_id":"T1113","description":"MoustachedBouncer has used plugins to take screenshots on targeted systems.","sources":[{"source":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]},{"technique_id":"T1659","description":"MoustachedBouncer has injected content into DNS, HTTP, and SMB replies to redirect specifically-targeted victims to a fake Windows Update page to download malware.","sources":[{"source":"MoustachedBouncer ESET August 2023","url":"https://www.welivesecurity.com/en/eset-research/moustachedbouncer-espionage-against-foreign-diplomats-in-belarus/"}]}]},{"id":"G0069","name":"MuddyWater","procedures":[{"technique_id":"T1003.001","description":"MuddyWater has performed credential dumping with Mimikatz and procdump64.exe.","sources":[{"source":"Unit 42 MuddyWater Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"},{"source":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1003.004","description":"MuddyWater has performed credential dumping with LaZagne.","sources":[{"source":"Unit 42 MuddyWater Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"},{"source":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"}]},{"technique_id":"T1003.005","description":"MuddyWater has performed credential dumping with LaZagne.","sources":[{"source":"Unit 42 MuddyWater Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"},{"source":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"}]},{"technique_id":"T1016","description":"MuddyWater has used malware to collect the victim’s IP address and domain name.","sources":[{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"}]},{"technique_id":"T1027.003","description":"MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.","sources":[{"source":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"}]},{"technique_id":"T1027.004","description":"MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.","sources":[{"source":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"}]},{"technique_id":"T1027.010","description":"MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts. The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.","sources":[{"source":"Talos MuddyWater May 2019","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"},{"source":"GitHub Invoke-Obfuscation","url":"https://github.com/danielbohannon/Invoke-Obfuscation"},{"source":"ClearSky MuddyWater June 2019","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"},{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source":"Unit 42 MuddyWater Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"},{"source":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"}]},{"technique_id":"T1033","description":"MuddyWater has used malware that can collect the victim’s username.","sources":[{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1036.005","description":"MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.","sources":[{"source":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"},{"source":"Talos MuddyWater May 2019","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"},{"source":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"}]},{"technique_id":"T1041","description":"MuddyWater has used C2 infrastructure to receive exfiltrated data.","sources":[{"source":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"}]},{"technique_id":"T1047","description":"MuddyWater has used malware that leveraged WMI for execution and querying host information.","sources":[{"source":"Talos MuddyWater May 2019","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"},{"source":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"},{"source":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"},{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"}]},{"technique_id":"T1049","description":"MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.","sources":[{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1053.005","description":"MuddyWater has used scheduled tasks to establish persistence.","sources":[{"source":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"}]},{"technique_id":"T1057","description":"MuddyWater has used malware to obtain a list of running processes on the system.","sources":[{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source":"ClearSky MuddyWater June 2019","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"}]},{"technique_id":"T1059.001","description":"MuddyWater has used PowerShell for execution.","sources":[{"source":"Talos MuddyWater May 2019","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"},{"source":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"},{"source":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"},{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"},{"source":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"},{"source":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"},{"source":"MuddyWater TrendMicro June 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/another-potential-muddywater-campaign-uses-powershell-based-prb-backdoor/"}]},{"technique_id":"T1059.003","description":"MuddyWater has used a custom tool for creating reverse shells.","sources":[{"source":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"}]},{"technique_id":"T1059.005","description":"MuddyWater has used VBScript files to execute its POWERSTATS payload, as well as macros.","sources":[{"source":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"},{"source":"ClearSky MuddyWater June 2019","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"},{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"},{"source":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"},{"source":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"},{"source":"MuddyWater TrendMicro June 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/another-potential-muddywater-campaign-uses-powershell-based-prb-backdoor/"}]},{"technique_id":"T1059.006","description":"MuddyWater has developed tools in Python including Out1.","sources":[{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1059.007","description":"MuddyWater has used JavaScript files to execute its POWERSTATS payload.","sources":[{"source":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"},{"source":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"},{"source":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"}]},{"technique_id":"T1071.001","description":"MuddyWater has used HTTP for C2 communications.","sources":[{"source":"ClearSky MuddyWater June 2019","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1074.001","description":"MuddyWater has stored a decoy PDF file within a victim's %temp% folder.","sources":[{"source":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"}]},{"technique_id":"T1082","description":"MuddyWater has used malware that can collect the victim’s OS version and machine name.","sources":[{"source":"Talos MuddyWater May 2019","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"},{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"}]},{"technique_id":"T1083","description":"MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords \"Kasper,\" \"Panda,\" or \"ESET.\"","sources":[{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"}]},{"technique_id":"T1087.002","description":"MuddyWater has used cmd.exe net user /domain to enumerate domain users.","sources":[{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1090","description":"MuddyWater has used NordVPN to proxy phishing emails, making them appear to originate from France.","sources":[{"source":"FalconFeeds_Iran_Mar2026","url":"https://falconfeeds.io/blogs/the-digital-redoubt-irans-national-information-network-cyber-conflict"}]},{"technique_id":"T1090.002","description":"MuddyWater has controlled POWERSTATS from behind a proxy network to obfuscate the C2 location. MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2). MuddyWater has also used go-socks5 variants to bypass firewalls and Network Address Translation (NAT), to communicate with a hardcoded C2 server, and to exfiltrate data.","sources":[{"source":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"},{"source":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"}]},{"technique_id":"T1102.002","description":"MuddyWater has used web services including OneHub to distribute remote access tools.","sources":[{"source":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"}]},{"technique_id":"T1104","description":"MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.","sources":[{"source":"Talos MuddyWater May 2019","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"}]},{"technique_id":"T1105","description":"MuddyWater has used malware that can upload additional files to the victim’s machine. MuddyWater has used PowerShell commands to install remote management and monitoring (RMM) software on the victim’s machine to conduct espionage and to exfiltrate data.","sources":[{"source":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"},{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"}]},{"technique_id":"T1113","description":"MuddyWater has used malware that can capture screenshots of the victim’s machine.","sources":[{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"}]},{"technique_id":"T1132.001","description":"MuddyWater has used tools to encode C2 communications including Base64 encoding.","sources":[{"source":"ClearSky MuddyWater June 2019","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1137.001","description":"MuddyWater has used a Word Template, Normal.dotm, for persistence.","sources":[{"source":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"}]},{"technique_id":"T1140","description":"MuddyWater has decoded base64-encoded PowerShell, JavaScript, and VBScript.","sources":[{"source":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"},{"source":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"},{"source":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"},{"source":"MuddyWater TrendMicro June 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/another-potential-muddywater-campaign-uses-powershell-based-prb-backdoor/"}]},{"technique_id":"T1190","description":"MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).","sources":[{"source":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}]},{"technique_id":"T1203","description":"MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.","sources":[{"source":"ClearSky MuddyWater June 2019","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"}]},{"technique_id":"T1204.001","description":"MuddyWater has distributed URLs in phishing e-mails that link to lure documents.","sources":[{"source":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"},{"source":"Proofpoint TA450 Phishing March 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1204.002","description":"MuddyWater has attempted to get users to open malicious PDF attachment and to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails. Additionally, MuddyWater has used a Word document with a malicious Visual Basic for Applications (VBA) macro; when enabled, the CertificationKit.ini payload is constructed and executed.","sources":[{"source":"Talos MuddyWater May 2019","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"},{"source":"CloudSEK_RustyWater_Jan2026","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"},{"source":"ClearSky MuddyWater June 2019","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"},{"source":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"},{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source":"Unit 42 MuddyWater Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"},{"source":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"},{"source":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"},{"source":"Proofpoint TA450 Phishing March 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"},{"source":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"}]},{"technique_id":"T1204.004","description":"MuddyWater has leveraged ClickFix type tactics enticing victims to copy and paste malicious PowerShell code.","sources":[{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}]},{"technique_id":"T1210","description":"MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).","sources":[{"source":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}]},{"technique_id":"T1218.003","description":"MuddyWater has used CMSTP.exe and a malicious INF to execute its POWERSTATS payload.","sources":[{"source":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"}]},{"technique_id":"T1218.005","description":"MuddyWater has used mshta.exe to execute its POWERSTATS payload and to pass a PowerShell one-liner for execution.","sources":[{"source":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"},{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"}]},{"technique_id":"T1218.011","description":"MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.","sources":[{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"}]},{"technique_id":"T1219.002","description":"MuddyWater has leveraged RMM solutions including ScreenConnect, AteraAgent, SimpleHelp, Action1, Level, and PDQ to facilitate follow-on actions within compromised hosts to include data exfiltration.","sources":[{"source":"FalconFeeds_Iran_Mar2026","url":"https://falconfeeds.io/blogs/the-digital-redoubt-irans-national-information-network-cyber-conflict"},{"source":"FalconFeeds_MuddyWaterPSRust_Mar2026","url":"https://falconfeeds.io/blogs/muddywater-in-the-iran-israel-cyber-war-from-powershell-scripts-to-rust-implants"},{"source":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"},{"source":"Proofpoint TA450 Phishing March 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source":"group-ib_muddywater_infra","url":"https://www.group-ib.com/blog/muddywater-infrastructure/"}]},{"technique_id":"T1518","description":"MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.","sources":[{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1518.001","description":"MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.","sources":[{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"}]},{"technique_id":"T1534","description":"MuddyWater has used compromised mailboxes within target organizations to send spearphishing emails.","sources":[{"source":"FalconFeeds_Iran_Mar2026","url":"https://falconfeeds.io/blogs/the-digital-redoubt-irans-national-information-network-cyber-conflict"}]},{"technique_id":"T1547.001","description":"MuddyWater has added Registry Run key KCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\SystemTextEncoding to establish persistence.","sources":[{"source":"Talos MuddyWater May 2019","url":"https://blog.talosintelligence.com/2019/05/recent-muddywater-associated-blackwater.html"},{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source":"Reaqta MuddyWater November 2017","url":"https://reaqta.com/2017/11/muddywater-apt-targeting-middle-east/"},{"source":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"}]},{"technique_id":"T1548.002","description":"MuddyWater uses various techniques to bypass UAC.","sources":[{"source":"ClearSky MuddyWater Nov 2018","url":"https://www.clearskysec.com/wp-content/uploads/2018/11/MuddyWater-Operations-in-Lebanon-and-Oman.pdf"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}]},{"technique_id":"T1552.001","description":"MuddyWater has run a tool that steals passwords saved in victim email.","sources":[{"source":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"}]},{"technique_id":"T1555","description":"MuddyWater has performed credential dumping with LaZagne and other tools, including by dumping passwords saved in victim email.","sources":[{"source":"Unit 42 MuddyWater Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"},{"source":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1555.003","description":"MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.","sources":[{"source":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1559.001","description":"MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.","sources":[{"source":"ClearSky MuddyWater June 2019","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"},{"source":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"},{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"}]},{"technique_id":"T1559.002","description":"MuddyWater has used malware that can execute PowerShell scripts via DDE.","sources":[{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"}]},{"technique_id":"T1560.001","description":"MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.","sources":[{"source":"Symantec MuddyWater Dec 2018","url":"https://www.symantec.com/blogs/threat-intelligence/seedworm-espionage-group"}]},{"technique_id":"T1566","description":"MuddyWater has sent phishing emails to targets from the email address support@microsoftonlines[.]com.","sources":[{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}]},{"technique_id":"T1566.001","description":"MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients. MuddyWater has also sent spearphishing emails with the attachment Cybersecurity.doc, which served as the primarily payload for the next stage.","sources":[{"source":"CloudSEK_RustyWater_Jan2026","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"},{"source":"ClearSky MuddyWater June 2019","url":"https://www.clearskysec.com/wp-content/uploads/2019/06/Clearsky-Iranian-APT-group-%E2%80%98MuddyWater%E2%80%99-Adds-Exploits-to-Their-Arsenal.pdf"},{"source":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"},{"source":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"},{"source":"Securelist MuddyWater Oct 2018","url":"https://securelist.com/muddywater/88059/"},{"source":"Unit 42 MuddyWater Nov 2017","url":"https://researchcenter.paloaltonetworks.com/2017/11/unit42-muddying-the-water-targeted-attacks-in-the-middle-east/"},{"source":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"},{"source":"Proofpoint TA450 Phishing March 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"},{"source":"FireEye MuddyWater Mar 2018","url":"https://www.fireeye.com/blog/threat-research/2018/03/iranian-threat-group-updates-ttps-in-spear-phishing-campaign.html"},{"source":"SOCRadar_MuddyWaterDindoor_Mar2026","url":"https://socradar.io/blog/iran-muddywater-dindoor-malware-us-networks/"}]},{"technique_id":"T1566.002","description":"MuddyWater has sent targeted spearphishing e-mails with malicious links.","sources":[{"source":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"},{"source":"Proofpoint TA450 Phishing March 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1567.002","description":"MuddyWater has attempted to exfiltrate data to Wasabi, a cloud storage service, using Rclone.","sources":[{"source":"SOCRadar_MuddyWaterDindoor_Mar2026","url":"https://socradar.io/blog/iran-muddywater-dindoor-malware-us-networks/"}]},{"technique_id":"T1571","description":"MuddyWater has used ports 8043 and 8848 for botnet C2 communication.","sources":[{"source":"FalconFeeds_MuddyWaterPSRust_Mar2026","url":"https://falconfeeds.io/blogs/muddywater-in-the-iran-israel-cyber-war-from-powershell-scripts-to-rust-implants"}]},{"technique_id":"T1573.001","description":"MuddyWater has used AES to encrypt C2 responses.","sources":[{"source":"Talos MuddyWater Jan 2022","url":"https://blog.talosintelligence.com/2022/01/iranian-apt-muddywater-targets-turkey.html"}]},{"technique_id":"T1574.001","description":"MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.","sources":[{"source":"DHS CISA AA22-055A MuddyWater February 2022","url":"https://www.cisa.gov/uscert/ncas/alerts/aa22-055a"}]},{"technique_id":"T1583.001","description":"MuddyWater has established domains, some of which appeared to spoof legitimate domains for use in operations.","sources":[{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}]},{"technique_id":"T1583.006","description":"MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.","sources":[{"source":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"},{"source":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"},{"source":"Proofpoint TA450 Phishing March 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/security-brief-ta450-uses-embedded-links-pdf-attachments-latest-campaign"},{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]},{"technique_id":"T1588.001","description":"MuddyWater has used publicly available malware for operations, likely to blend in with other cybercriminals.","sources":[{"source":"Huntio_IranInfra_Mar2026","url":"https://hunt.io/blog/iranian-apt-infrastructure-state-aligned-clusters"}]},{"technique_id":"T1588.002","description":"MuddyWater has used legitimate tools ConnectWise, RemoteUtilities, and SimpleHelp to gain access to the target environment.","sources":[{"source":"ESET_MuddyWater_Dec2025","url":"https://www.welivesecurity.com/en/eset-research/muddywater-snakes-riverbank/"},{"source":"Anomali Static Kitten February 2021","url":"https://www.anomali.com/blog/probable-iranian-cyber-actors-static-kitten-conducting-cyberespionage-campaign-targeting-uae-and-kuwait-government-agencies"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"},{"source":"group-ib_muddywater_infra","url":"https://www.group-ib.com/blog/muddywater-infrastructure/"}]},{"technique_id":"T1590.004","description":"MuddyWater has mapped target networks; access to this information and more is then shared/sold to other Iran threat actors.","sources":[{"source":"FalconFeeds_MuddyWaterPSRust_Mar2026","url":"https://falconfeeds.io/blogs/muddywater-in-the-iran-israel-cyber-war-from-powershell-scripts-to-rust-implants"}]},{"technique_id":"T1684.001","description":"MuddyWater has used support@microsoftonlines.]com to send phishing emails that masqueraded as security updates from Microsoft. [MuddyWater has also impersonated TMCell (Altyn Asyr CJSC), the primary mobile operator in Turkmenistan, sending phishing emails with the email domain info@tmcell.","sources":[{"source":"CloudSEK_RustyWater_Jan2026","url":"https://www.cloudsek.com/blog/reborn-in-rust-muddywater-evolves-tooling-with-rustywater-implant"},{"source":"NaumaanProofpoint_GlobalClickFix_April2025","url":"https://www.proofpoint.com/us/blog/threat-insight/around-world-90-days-state-sponsored-actors-try-clickfix"}]},{"technique_id":"T1685","description":"MuddyWater can disable the system's local proxy settings.","sources":[{"source":"Trend Micro Muddy Water March 2021","url":"https://www.trendmicro.com/en_us/research/21/c/earth-vetala---muddywater-continues-to-target-organizations-in-t.html"}]}]},{"id":"G0129","name":"Mustang Panda","procedures":[{"technique_id":"T1001.003","description":"Mustang Panda has utilized TLS record headers in network packets to impersonate various versions of TLS protocols to blend in with legitimate network traffic. Mustang Panda has used FakeTLS to communicate with its C2 servers.","sources":[{"source":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"technique_id":"T1003","description":"Mustang Panda utilized “Hdump” to dump credentials from memory.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1003.001","description":"Mustang Panda has harvested credentials from memory of lssas.exe with Mimikatz.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1003.003","description":"Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file. Mustang Panda has also used reg save on the SYSTEM file Registry location to help extract the NTDS.dit file.","sources":[{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1003.006","description":"Mustang Panda has leveraged Mimikatz DCSync feature to obtain user credentials.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1016","description":"Mustang Panda has used ipconfig and arp to determine network configuration information. Mustang Panda has also utilized SharpNBTScan to scan the victim environment.","sources":[{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"},{"source":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"technique_id":"T1018","description":"Mustang Panda has queried Active Directory for computers using AdFind. Mustang Panda has also utilized SharpNBTScan to scan the victim environment.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"},{"source":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"technique_id":"T1027","description":"Mustang Panda has delivered initial payloads hidden using archives and encoding measures. Mustang Panda has also utilized opaque predicates in payloads to hinder analysis.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source":"Crowdstrike MUSTANG PANDA June 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"},{"source":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source":"Proofpoint TA416 November 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"},{"source":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"},{"source":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"technique_id":"T1027.007","description":"Mustang Panda has leveraged obfuscated Windows API function calls that were concealed as unique names, or hashes of the Windows API.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}]},{"technique_id":"T1027.012","description":"Mustang Panda has utilized LNK files to hide malicious scripts for execution. Mustang Panda has also leveraged LNK files that were programmed to display a PDF icon to entice the victim to click on the file to execute an office.exe binary.","sources":[{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}]},{"technique_id":"T1027.016","description":"Mustang Panda has used junk code within their DLL files to hinder analysis.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"}]},{"technique_id":"T1036.005","description":"Mustang Panda has used names like adobeupdate.dat and PotPlayerDB.dat to disguise PlugX, and a file named OneDrive.exe to load a Cobalt Strike payload. Mustang Panda has also masqueraded legitimate browser plugin updates to include AdobePlugins.exe.","sources":[{"source":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"}]},{"technique_id":"T1036.007","description":"Mustang Panda has used an additional filename extension to hide the true file type.","sources":[{"source":"Crowdstrike MUSTANG PANDA June 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"},{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"}]},{"technique_id":"T1036.008","description":"Mustang Panda has masqueraded malicious executables as legitimate files that download PlugX malware.","sources":[{"source":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"}]},{"technique_id":"T1041","description":"Mustang Panda has exfiltrated stolen data and files to its C2 server.","sources":[{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"}]},{"technique_id":"T1046","description":"Mustang Panda has leveraged NBTscan to scan IP networks.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1047","description":"Mustang Panda has executed PowerShell scripts via WMI.","sources":[{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"}]},{"technique_id":"T1048.003","description":"Mustang Panda has used FTP to exfiltrate archive files.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1049","description":"Mustang Panda has used netstat -ano to determine network connection information.","sources":[{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"}]},{"technique_id":"T1052.001","description":"Mustang Panda has used a customized PlugX variant which could exfiltrate documents from air-gapped networks.","sources":[{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"}]},{"technique_id":"T1053.005","description":"Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence. Mustang Panda has also created a scheduled task that creates a reverse shell.","sources":[{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source":"McAfee Dianxun March 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"},{"source":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"technique_id":"T1057","description":"Mustang Panda has used tasklist /v to determine active process information. Mustang Panda has also used TONESHELL malware to check the process name and process path to ensure it matches the expected one prior to triggering a custom exception handler.","sources":[{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"},{"source":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"technique_id":"T1059","description":"Mustang Panda has utilized meterpreter shellcode.","sources":[{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"}]},{"technique_id":"T1059.001","description":"Mustang Panda has used malicious PowerShell scripts to enable execution.","sources":[{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source":"Crowdstrike MUSTANG PANDA June 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"},{"source":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"technique_id":"T1059.003","description":"Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection. Mustang Panda has also utilized cmd.exe to execute commands on an infected host such as cmd.exe /c ping.exe 8.8.8.8 -n 70&&\"%temp%\\FontEDL.exe\".","sources":[{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"}]},{"technique_id":"T1059.005","description":"Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection. Mustang Panda has also used VBA macros in maldocs to execute malicious DLLs. Mustang Panda also utilized a VBS Script “autorun.vbs” that created persistence through saving the VBS Script in the startup directory which would cause it to run each time the machine was turned on.","sources":[{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"},{"source":"Crowdstrike MUSTANG PANDA June 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"}]},{"technique_id":"T1059.007","description":"Mustang Panda has executed a JavaScript payload utilizing wscript.exe on the endpoint.","sources":[{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"}]},{"technique_id":"T1069.002","description":"Mustang Panda has leveraged AdFind to enumerate domain groups.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1070","description":"Mustang Panda has deleted registry keys that store data and maintained persistence.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}]},{"technique_id":"T1070.004","description":"Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.","sources":[{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"technique_id":"T1070.006","description":"Mustang Panda has modified file timestamps from the export address table (EAT) in malware to make it difficult to identify creation times.","sources":[{"source":"Palo Alto Networks, Unit 42","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"}]},{"technique_id":"T1071.001","description":"Mustang Panda has communicated with its C2 via HTTP POST requests.","sources":[{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source":"McAfee Dianxun March 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"}]},{"technique_id":"T1072","description":"Mustang Panda has leveraged legitimate software tools such as AntiVirus Agents, Security Services, and App Development tools to execute scripts and to side-load dlls.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"},{"source":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"}]},{"technique_id":"T1074.001","description":"Mustang Panda has stored collected credential files in c:\\windows\\temp prior to exfiltration. Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.","sources":[{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"}]},{"technique_id":"T1082","description":"Mustang Panda has gathered system information using systeminfo.","sources":[{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"}]},{"technique_id":"T1083","description":"Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.","sources":[{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"},{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1087.002","description":"Mustang Panda has utilized AdFind to identify domain users.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1091","description":"Mustang Panda has used a customized PlugX variant which could spread through USB connections.","sources":[{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"}]},{"technique_id":"T1095","description":"Mustang Panda has utilized TCP-based reverse shells using cmd.exe.","sources":[{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"}]},{"technique_id":"T1102","description":"Mustang Panda has used DropBox URLs to deliver variants of PlugX. Mustang Panda has also used Google Drive to host malicious downloads.","sources":[{"source":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}]},{"technique_id":"T1105","description":"Mustang Panda has downloaded additional executables following the initial infection stage. Mustang Panda has also leveraged Visual Studio Code code.exe and Dev Tunnels using DevTunnel.exe to propagate additional tools and payloads.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"technique_id":"T1106","description":"Mustang Panda has used various Windows API calls during execution and defense evasion.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source":"Broadcom","url":"https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"},{"source":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source":"Palo Alto Networks, Unit 42","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"},{"source":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"},{"source":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"},{"source":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"technique_id":"T1119","description":"Mustang Panda used custom batch scripts to collect files automatically from a targeted system.","sources":[{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"}]},{"technique_id":"T1129","description":"Mustang Panda has leveraged LoadLibrary to load DLLs.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"}]},{"technique_id":"T1140","description":"Mustang Panda has the ability to decrypt its payload prior to execution. Mustang Panda has also utilized RC4 encryption for malicious payloads.","sources":[{"source":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source":"Palo Alto Networks, Unit 42","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"},{"source":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}]},{"technique_id":"T1176.002","description":"Mustang Panda has leveraged Visual Studio Code’s (VSCode) embedded reverse shell feature using the command code.exe tunnel to execute code and deliver additional payloads.","sources":[{"source":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"technique_id":"T1203","description":"Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.","sources":[{"source":"Crowdstrike MUSTANG PANDA June 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"}]},{"technique_id":"T1204.001","description":"Mustang Panda has sent malicious links including links directing victims to a Google Drive folder. Mustang Panda has also utilized webpages with Javascript code that downloads malicious payloads to the victim device.","sources":[{"source":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source":"Crowdstrike MUSTANG PANDA June 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"},{"source":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source":"McAfee Dianxun March 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"}]},{"technique_id":"T1204.002","description":"Mustang Panda has sent malicious files requiring direct victim interaction to execute. Mustang Panda has also leveraged executable files that display decoy documents to the victim to provide a resemblance of legitimacy with customized themes related to the victim.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"},{"source":"Google TAG Ukraine Threat Landscape March 2022","url":"https://blog.google/threat-analysis-group/update-threat-landscape-ukraine"},{"source":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"},{"source":"Crowdstrike MUSTANG PANDA June 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/"},{"source":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"},{"source":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source":"Palo Alto Networks, Unit 42","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"},{"source":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"},{"source":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"technique_id":"T1205","description":"Mustang Panda has utilized a magic value in C2 communications and only executes in memory when response packets match specific values of “17 03 03” or “46 77 4d”.","sources":[{"source":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"}]},{"technique_id":"T1218.004","description":"Mustang Panda has used InstallUtil.exe to execute a malicious Beacon stager.","sources":[{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"}]},{"technique_id":"T1218.005","description":"Mustang Panda has used mshta.exe to launch collection scripts.","sources":[{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"}]},{"technique_id":"T1219.001","description":"Mustang Panda has utilized an established Github account to create a tunnel within the victim environment using Visual Studio Code through the code.exe tunnel command.","sources":[{"source":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"technique_id":"T1219.002","description":"Mustang Panda has installed TeamViewer on targeted systems.","sources":[{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"}]},{"technique_id":"T1505.003","description":"Mustang Panda has used China Chopper web shells to maintain access to victims’ environments.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1518","description":"Mustang Panda has searched the victim system for the InstallUtil.exe program and its version.","sources":[{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"}]},{"technique_id":"T1546.003","description":"Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.","sources":[{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"}]},{"technique_id":"T1547.001","description":"Mustang Panda has created the registry key HKEY_LOCAL_MACHINE\\SOFTWARE\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Run\\AdobelmdyU to maintain persistence. Mustang Panda has also established persistence via the registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.","sources":[{"source":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source":"Proofpoint TA416 November 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"},{"source":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}]},{"technique_id":"T1553.002","description":"Mustang Panda has used valid legitimate digital signatures and certificates to evade detection.","sources":[{"source":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source":"Palo Alto Networks, Unit 42","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"},{"source":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"},{"source":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"technique_id":"T1557","description":"Mustang Panda leveraged a captive portal hijack that redirected the victim to a webpage that prompted the victim to download a malicious payload.","sources":[{"source":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"}]},{"technique_id":"T1560.001","description":"Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration. Mustang Panda has used WinRAR “Rar.exe” to archive stolen files before exfiltration. Mustang Panda has also used TONESHELL and post-exploitation tools such as RemCom and Impacket to execute WinRAR rar.exe to archive files for exfiltration.","sources":[{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"},{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"},{"source":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"technique_id":"T1560.003","description":"Mustang Panda has encrypted documents with RC4 prior to exfiltration.","sources":[{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"}]},{"technique_id":"T1564.001","description":"Mustang Panda's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data. Mustang Panda has also modified file attributes to hidden and system.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source":"Avira Mustang Panda January 2020","url":"https://www.avira.com/en/blog/new-wave-of-plugx-targets-hong-kong"}]},{"technique_id":"T1566.001","description":"Mustang Panda has used spearphishing attachments to deliver initial access payloads. Mustang Panda has also delivered archive files such as RAR and ZIP files containing legitimate EXEs and malicious DLLs.","sources":[{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source":"Google TAG Ukraine Threat Landscape March 2022","url":"https://blog.google/threat-analysis-group/update-threat-landscape-ukraine"},{"source":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source":"Trend Micro MUSTANG PANDA PUBLOAD HIUPAN SEPTEMBER 2024","url":"https://www.trendmicro.com/en_us/research/24/i/earth-preta-new-malware-and-strategies.html"},{"source":"Proofpoint TA416 November 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"}]},{"technique_id":"T1566.002","description":"Mustang Panda has delivered malicious links to their intended targets. Mustang Panda has distributed spear-phishing emails with embedded links that direct the victim to a malicious archive hosted on Google or Dropbox.","sources":[{"source":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source":"McAfee Dianxun March 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"}]},{"technique_id":"T1567.002","description":"Mustang Panda has also exfiltrated archived files to cloud services such as Dropbox using curl.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"},{"source":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"technique_id":"T1572","description":"Mustang Panda has leveraged OpenSSH (sshd.exe) to execute commands, transfer files and spread across the environment communicating over SMB port 445.","sources":[{"source":"Unit42 Chinese VSCode 06 September 2024","url":"https://unit42.paloaltonetworks.com/stately-taurus-abuses-vscode-southeast-asian-espionage/"}]},{"technique_id":"T1573.001","description":"Mustang Panda has encrypted C2 communications with RC4. Mustang Panda has also leveraged encryption and compression algorithms to obfuscate the traffic between the system and C2 server, methods observed included RC4, AES, XOR with 0x5a, and LZO.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"}]},{"technique_id":"T1574.001","description":"Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file. Mustang Panda has abused legitimate executables to side-load malicious DLLs.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source":"Anomali MUSTANG PANDA October 2019","url":"https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations"},{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source":"Broadcom","url":"https://www.broadcom.com/support/security-center/protection-bulletin/bookworm-malware-linked-to-fireant-aka-stately-tarurus-activity-observed-in-southeast-asia"},{"source":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"},{"source":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source":"Proofpoint TA416 November 2020","url":"https://www.proofpoint.com/us/blog/threat-insight/ta416-goes-ground-and-returns-golang-plugx-malware-loader"},{"source":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"},{"source":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"},{"source":"Zscaler","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-toneshell-and-starproxy-p1"}]},{"technique_id":"T1574.005","description":"Mustang Panda has leveraged legitimate software installer executables such as Setup Factory “IRSetup.exe” to drop and execute their payload.","sources":[{"source":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"}]},{"technique_id":"T1583.001","description":"Mustang Panda has acquired C2 domains prior to operations.","sources":[{"source":"Secureworks BRONZE PRESIDENT December 2019","url":"https://www.secureworks.com/research/bronze-president-targets-ngos"},{"source":"CSIRT CTI MUSTANG PANDA PUBLOAD TONESHELL JAN 2024","url":"https://csirt-cti.net/2024/01/23/stately-taurus-targets-myanmar/"},{"source":"Lab52 MUSTANG PANDA PUBLOAD MAY 2023","url":"https://lab52.io/blog/new-mustang-pandas-campaing-against-australia/"},{"source":"Recorded Future REDDELTA July 2020","url":"https://go.recordedfuture.com/hubfs/reports/cta-2020-0728.pdf"},{"source":"Trend Micro Mustang Panda Earth Preta Toneshell February 2025","url":"https://www.trendmicro.com/en_us/research/25/b/earth-preta-mixes-legitimate-and-malicious-components-to-sidestep-detection.html"},{"source":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"},{"source":"Unit42 Bookworm Nov2015","url":"https://unit42.paloaltonetworks.com/bookworm-trojan-a-model-of-modular-architecture/"},{"source":"Palo Alto Networks, Unit 42","url":"https://unit42.paloaltonetworks.com/stately-taurus-uses-bookworm-malware/"},{"source":"McAfee Dianxun March 2021","url":"https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-dianxun.pdf"}]},{"technique_id":"T1583.006","description":"Mustang Panda has set up Dropbox and Google Drive to host malicious downloads.","sources":[{"source":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"technique_id":"T1585.002","description":"Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns. Mustang Panda has also created fake Google accounts to distribute malware via spear-phishing emails. Mustang Panda has also created accounts for spearphishing operations including the use of services such as Proton Mail.","sources":[{"source":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"},{"source":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}]},{"technique_id":"T1586.002","description":"Mustang Panda has compromised legitimate email accounts to use in their spear-phishing operations.","sources":[{"source":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"}]},{"technique_id":"T1587.001","description":"Mustang Panda has developed custom malware for use in their operations.","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"}]},{"technique_id":"T1588.002","description":"Mustang Panda has obtained and leveraged publicly-available tools for intrusion activities.","sources":[{"source":"Cisco Talos MUSTANG PANDA PLUGX PUBLOAD MAY 2022","url":"https://blog.talosintelligence.com/mustang-panda-targets-europe/"},{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1588.003","description":"Mustang Panda has used revoked code signing certificates for its malicious payloads.","sources":[{"source":"Zscaler PAKLOG CorkLog SplatCloak Splatdropper April 2025","url":"https://www.zscaler.com/blogs/security-research/latest-mustang-panda-arsenal-paklog-corklog-and-splatcloak-p2"}]},{"technique_id":"T1588.004","description":"Mustang Panda has obtained SSL certificates for their C2 domains.","sources":[{"source":"EclecticIQ Mustang Panda PlugX","url":"https://blog.eclecticiq.com/mustang-panda-apt-group-uses-european-commission-themed-lure-to-deliver-plugx-malware"},{"source":"Google Threat Intelligence Group MUSTANG PANDA PLUGX August 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/prc-nexus-espionage-targets-diplomats"}]},{"technique_id":"T1593","description":"Mustang Panda has used open-source research to identify information about victims to use in targeting to include creating weaponized phishing lures and attachments.","sources":[{"source":"IBM MUSTANG PANDA PUBLOAD CLAIMLOADER JUNE 2025","url":"https://www.ibm.com/think/x-force/hive0154-mustang-panda-shifts-focus-tibetan-community-deploy-pubload-backdoor"},{"source":"2025_IBM_PUBLOAD_TONESHELL_HIUPAN_CLAIMLOADER_MUSTANG PANDA","url":"https://www.ibm.com/think/x-force/hive0154-targeting-us-philippines-pakistan-taiwan"}]},{"technique_id":"T1598.003","description":"Mustang Panda has delivered web bugs to profile their intended targets.","sources":[{"source":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}]},{"technique_id":"T1608","description":"Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims.","sources":[{"source":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}]},{"technique_id":"T1608.001","description":"Mustang Panda has hosted malicious payloads on DropBox including PlugX.","sources":[{"source":"Proofpoint TA416 Europe March 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/good-bad-and-web-bug-ta416-increases-operational-tempo-against-european"}]},{"technique_id":"T1622","description":"Mustang Panda has embedded debug strings with messages to distract analysts. Mustang Panda has also made calls to Windows API CheckRemoteDebuggerPresent and exits if it detects a debugger.","sources":[{"source":"2022 November_TrendMicro_Earth Preta_Toneshell_Pubload","url":"https://www.trendmicro.com/en_us/research/22/k/earth-preta-spear-phishing-governments-worldwide.html"},{"source":"Sophos Mustang Panda PLUGX","url":"https://www.secureworks.com/blog/bronze-president-targets-government-officials"}]},{"technique_id":"T1654","description":"Mustang Panda has used Wevtutil to gather Windows Security Event Logs.","sources":[{"source":"Palo Alto Unit42 STATELY TAURUS TONESHELL September 2023","url":"https://unit42.paloaltonetworks.com/stately-taurus-attacks-se-asian-government/"}]},{"technique_id":"T1678","description":"Mustang Panda has delayed the execution of payloads leveraging ping echo requests cmd /c ping 8.8.8.8 -n 70&&\"%temp%\\\".","sources":[{"source":"Eset PlugX Korplug Mustang Panda March 2022","url":"https://www.welivesecurity.com/2022/03/23/mustang-panda-hodur-old-tricks-new-korplug-variant/"},{"source":"Sophos PlugX September 2022","url":"https://www.secureworks.com/blog/bronze-president-targets-russian-speakers-with-updated-plugx"}]}]},{"id":"G1020","name":"Mustard Tempest","procedures":[{"technique_id":"T1036.005","description":"Mustard Tempest has used the filename AutoUpdater.js to mimic legitimate update files and has also used the Cyrillic homoglyph characters С (0xd0a1) and а (0xd0b0), to produce the filename Сhrome.Updаte.zip.","sources":[{"source":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source":"Red Canary SocGholish March 2024","url":"https://redcanary.com/threat-detection-report/threats/socgholish/"}]},{"technique_id":"T1082","description":"Mustard Tempest has used implants to perform system reconnaissance on targeted systems.","sources":[{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1105","description":"Mustard Tempest has deployed secondary payloads and third stage implants to compromised hosts.","sources":[{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1189","description":"Mustard Tempest has used drive-by downloads for initial infection, often using fake browser updates as a lure.","sources":[{"source":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source":"SentinelOne SocGholish Infrastructure November 2022","url":"https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/"},{"source":"Red Canary SocGholish March 2024","url":"https://redcanary.com/threat-detection-report/threats/socgholish/"},{"source":"Secureworks Gold Prelude Profile","url":"https://www.secureworks.com/research/threat-profiles/gold-prelude"}]},{"technique_id":"T1204.001","description":"Mustard Tempest has lured users into downloading malware through malicious links in fake advertisements and spearphishing emails.","sources":[{"source":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1566.002","description":"Mustard Tempest has sent victims emails containing links to compromised websites.","sources":[{"source":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"}]},{"technique_id":"T1583.004","description":"Mustard Tempest has acquired servers to host second-stage payloads that remain active for a period of either days, weeks, or months.","sources":[{"source":"SentinelOne SocGholish Infrastructure November 2022","url":"https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/"}]},{"technique_id":"T1583.008","description":"Mustard Tempest has posted false advertisements including for software packages and browser updates in order to distribute malware.","sources":[{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]},{"technique_id":"T1584.001","description":"Mustard Tempest operates a global network of compromised websites that redirect into a traffic distribution system (TDS) to select victims for a fake browser update page.","sources":[{"source":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source":"SentinelOne SocGholish Infrastructure November 2022","url":"https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/"},{"source":"Red Canary SocGholish March 2024","url":"https://redcanary.com/threat-detection-report/threats/socgholish/"},{"source":"Secureworks Gold Prelude Profile","url":"https://www.secureworks.com/research/threat-profiles/gold-prelude"}]},{"technique_id":"T1608.001","description":"Mustard Tempest has hosted payloads on acquired second-stage servers for periods of either days, weeks, or months.","sources":[{"source":"SentinelOne SocGholish Infrastructure November 2022","url":"https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/"}]},{"technique_id":"T1608.004","description":"Mustard Tempest has injected malicious JavaScript into compromised websites to infect victims via drive-by download.","sources":[{"source":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source":"SentinelOne SocGholish Infrastructure November 2022","url":"https://www.sentinelone.com/labs/socgholish-diversifies-and-expands-its-malware-staging-infrastructure-to-counter-defenders/"},{"source":"Red Canary SocGholish March 2024","url":"https://redcanary.com/threat-detection-report/threats/socgholish/"},{"source":"Secureworks Gold Prelude Profile","url":"https://www.secureworks.com/research/threat-profiles/gold-prelude"}]},{"technique_id":"T1608.006","description":"Mustard Tempest has poisoned search engine results to return fake software updates in order to distribute malware.","sources":[{"source":"SocGholish-update","url":"https://www.proofpoint.com/us/blog/threat-insight/part-1-socgholish-very-real-threat-very-fake-update"},{"source":"Microsoft Ransomware as a Service","url":"https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"}]}]},{"id":"G0019","name":"Naikon","procedures":[{"technique_id":"T1016","description":"Naikon uses commands such as netsh interface show to discover network interface settings.","sources":[{"source":"Baumgartner Naikon 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"technique_id":"T1018","description":"Naikon has used a netbios scanner for remote machine identification.","sources":[{"source":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"technique_id":"T1036.004","description":"Naikon renamed a malicious service taskmgr to appear to be a legitimate version of Task Manager.","sources":[{"source":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"technique_id":"T1036.005","description":"Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.","sources":[{"source":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"technique_id":"T1046","description":"Naikon has used the LadonGo scanner to scan target networks.","sources":[{"source":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"technique_id":"T1047","description":"Naikon has used WMIC.exe for lateral movement.","sources":[{"source":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"technique_id":"T1053.005","description":"Naikon has used schtasks.exe for lateral movement in compromised networks.","sources":[{"source":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"technique_id":"T1078.002","description":"Naikon has used administrator credentials for lateral movement in compromised networks.","sources":[{"source":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"technique_id":"T1137.006","description":"Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.","sources":[{"source":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"technique_id":"T1204.002","description":"Naikon has convinced victims to open malicious attachments to execute malware.","sources":[{"source":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"technique_id":"T1518.001","description":"Naikon uses commands such as netsh advfirewall firewall to discover local firewall settings.","sources":[{"source":"Baumgartner Naikon 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/07205555/TheNaikonAPT-MsnMM1.pdf"}]},{"technique_id":"T1547.001","description":"Naikon has modified a victim's Windows Run registry to establish persistence.","sources":[{"source":"Bitdefender Naikon April 2021","url":"https://www.bitdefender.com/files/News/CaseStudies/study/396/Bitdefender-PR-Whitepaper-NAIKON-creat5397-en-EN.pdf"}]},{"technique_id":"T1566.001","description":"Naikon has used malicious e-mail attachments to deliver malware.","sources":[{"source":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]},{"technique_id":"T1574.001","description":"Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.","sources":[{"source":"CheckPoint Naikon May 2020","url":"https://research.checkpoint.com/2020/naikon-apt-cyber-espionage-reloaded/"}]}]},{"id":"G0055","name":"NEODYMIUM","procedures":[]},{"id":"G0133","name":"Nomadic Octopus","procedures":[{"technique_id":"T1036","description":"Nomadic Octopus attempted to make Octopus appear as a Telegram Messenger with a Russian interface.","sources":[{"source":"Securelist Octopus Oct 2018","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"}]},{"technique_id":"T1059.001","description":"Nomadic Octopus has used PowerShell for execution.","sources":[{"source":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}]},{"technique_id":"T1059.003","description":"Nomadic Octopus used cmd.exe /c within a malicious macro.","sources":[{"source":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}]},{"technique_id":"T1105","description":"Nomadic Octopus has used malicious macros to download additional files to the victim's machine.","sources":[{"source":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}]},{"technique_id":"T1204.002","description":"Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.","sources":[{"source":"Securelist Octopus Oct 2018","url":"https://securelist.com/octopus-infested-seas-of-central-asia/88200/"},{"source":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}]},{"technique_id":"T1564.003","description":"Nomadic Octopus executed PowerShell in a hidden window.","sources":[{"source":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}]},{"technique_id":"T1566.001","description":"Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.","sources":[{"source":"Security Affairs DustSquad Oct 2018","url":"https://securityaffairs.co/wordpress/77165/apt/russia-linked-apt-dustsquad.html"},{"source":"ESET Nomadic Octopus 2018","url":"https://www.virusbulletin.com/uploads/pdf/conference_slides/2018/Cherepanov-VB2018-Octopus.pdf"}]}]},{"id":"G0049","name":"OilRig","procedures":[{"technique_id":"T1003.001","description":"OilRig has used credential dumping tools such as Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1003.004","description":"OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1003.005","description":"OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1005","description":"OilRig has used PowerShell to upload files from compromised systems.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"}]},{"technique_id":"T1007","description":"OilRig has used sc query on a victim to gather information about services.","sources":[]},{"technique_id":"T1008","description":"OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.","sources":[{"source":"OilRig ISMAgent July 2017","url":"https://researchcenter.paloaltonetworks.com/2017/07/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/"}]},{"technique_id":"T1012","description":"OilRig has used reg query “HKEY_CURRENT_USER\\Software\\Microsoft\\Terminal Server Client\\Default” on a victim to query the Registry.","sources":[]},{"technique_id":"T1016","description":"OilRig has run ipconfig /all on a victim.","sources":[]},{"technique_id":"T1021.001","description":"OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1021.004","description":"OilRig has used Putty to access compromised systems.","sources":[{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1025","description":"OilRig has used Wireshark’s usbcapcmd utility to capture USB traffic.","sources":[{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"technique_id":"T1027.005","description":"OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.","sources":[{"source":"Unit42 OilRig Nov 2018","url":"https://unit42.paloaltonetworks.com/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/"}]},{"technique_id":"T1027.013","description":"OilRig has encrypted and encoded data in its malware, including by using base64.","sources":[{"source":"Unit42 OilRig Nov 2018","url":"https://unit42.paloaltonetworks.com/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/"},{"source":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"},{"source":"Crowdstrike Helix Kitten Nov 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"},{"source":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1033","description":"OilRig has run whoami on a victim.","sources":[{"source":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"technique_id":"T1036","description":"OilRig has used .doc file extensions to mask malicious executables.","sources":[{"source":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"technique_id":"T1036.005","description":"OilRig has named a downloaded copy of the Plink tunneling utility as \\ProgramData\\Adobe.exe.","sources":[{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"technique_id":"T1046","description":"OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.","sources":[{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"}]},{"technique_id":"T1047","description":"OilRig has used WMI for execution.","sources":[{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"technique_id":"T1048.003","description":"OilRig has exfiltrated data via Microsoft Exchange and over FTP separately from its primary C2 channel over DNS.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"}]},{"technique_id":"T1049","description":"OilRig has used netstat -an on a victim to get a listing of network connections.","sources":[]},{"technique_id":"T1053.005","description":"OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.","sources":[{"source":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"},{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"technique_id":"T1056.001","description":"OilRig has employed keyloggers including KEYPUNCH and LONGWATCH.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"technique_id":"T1057","description":"OilRig has run tasklist on a victim's machine and used infostealers to capture processes.","sources":[{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"technique_id":"T1059","description":"OilRig has used various types of scripting for execution.","sources":[{"source":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"},{"source":"OilRig ISMAgent July 2017","url":"https://researchcenter.paloaltonetworks.com/2017/07/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/"},{"source":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"},{"source":"Unit42 OilRig Nov 2018","url":"https://unit42.paloaltonetworks.com/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/"}]},{"technique_id":"T1059.001","description":"OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"},{"source":"OilRig New Delivery Oct 2017","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"},{"source":"Crowdstrike Helix Kitten Nov 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"},{"source":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}]},{"technique_id":"T1059.003","description":"OilRig has used macros to deliver malware such as QUADAGENT and OopsIE. OilRig has used batch scripts.","sources":[{"source":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"},{"source":"OilRig ISMAgent July 2017","url":"https://researchcenter.paloaltonetworks.com/2017/07/unit42-oilrig-uses-ismdoor-variant-possibly-linked-greenbug-threat-group/"},{"source":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"},{"source":"Unit42 OilRig Nov 2018","url":"https://unit42.paloaltonetworks.com/unit42-analyzing-oilrigs-ops-tempo-testing-weaponization-delivery/"}]},{"technique_id":"T1059.005","description":"OilRig has used VBScript macros for execution on compromised hosts.","sources":[{"source":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"technique_id":"T1068","description":"OilRig has exploited the Windows Kernel Elevation of Privilege vulnerability, CVE-2024-30088.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"}]},{"technique_id":"T1069.001","description":"OilRig has used net localgroup administrators to find local administrators on compromised systems.","sources":[{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"technique_id":"T1069.002","description":"OilRig has used net group /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to find domain group permission settings.","sources":[]},{"technique_id":"T1070.004","description":"OilRig has deleted files associated with their payload after execution.","sources":[{"source":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"},{"source":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"}]},{"technique_id":"T1071.001","description":"OilRig has used HTTP for C2.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1071.004","description":"OilRig has used DNS for C2 including the publicly available requestbin.net tunneling service.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1078","description":"OilRig has used compromised credentials to access other systems on a victim network.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"IBM ZeroCleare Wiper December 2019","url":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1078.002","description":"OilRig has used an exfiltration tool named STEALHOOK to retreive valid domain credentials.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"}]},{"technique_id":"T1082","description":"OilRig has run hostname and systeminfo on a victim.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"},{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"technique_id":"T1087.001","description":"OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.","sources":[]},{"technique_id":"T1087.002","description":"OilRig has run net user, net user /domain, net group “domain admins” /domain, and net group “Exchange Trusted Subsystem” /domain to get account listings on a victim.","sources":[]},{"technique_id":"T1105","description":"OilRig had downloaded remote files onto victim infrastructure.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"},{"source":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"}]},{"technique_id":"T1110","description":"OilRig has used brute force techniques to obtain credentials.","sources":[{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"IBM ZeroCleare Wiper December 2019","url":"https://web.archive.org/web/20200211083637/https://securityintelligence.com/posts/new-destructive-wiper-zerocleare-targets-energy-sector-in-the-middle-east/"}]},{"technique_id":"T1112","description":"OilRig has used reg.exe to modify system configuration.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"},{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"technique_id":"T1113","description":"OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.","sources":[{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"}]},{"technique_id":"T1115","description":"OilRig has used infostealer tools to copy clipboard data.","sources":[{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"technique_id":"T1119","description":"OilRig has used automated collection.","sources":[{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1120","description":"OilRig has used tools to identify if a mouse is connected to a targeted system.","sources":[{"source":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"technique_id":"T1133","description":"OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.","sources":[{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"}]},{"technique_id":"T1137.004","description":"OilRig has abused the Outlook Home Page feature for persistence. OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.","sources":[{"source":"FireEye Outlook Dec 2019","url":"https://www.fireeye.com/blog/threat-research/2019/12/breaking-the-rules-tough-outlook-for-home-page-attacks.html"}]},{"technique_id":"T1140","description":"A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.","sources":[{"source":"FireEye APT34 Dec 2017","url":"https://www.fireeye.com/blog/threat-research/2017/12/targeted-attack-in-middle-east-by-apt34.html"},{"source":"OilRig New Delivery Oct 2017","url":"https://researchcenter.paloaltonetworks.com/2017/10/unit42-oilrig-group-steps-attacks-new-delivery-documents-new-injector-trojan/"},{"source":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"}]},{"technique_id":"T1195","description":"OilRig has leveraged compromised organizations to conduct supply chain attacks on government entities.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"}]},{"technique_id":"T1201","description":"OilRig has used net.exe in a script with net accounts /domain to find the password policy of a domain.","sources":[{"source":"FireEye Targeted Attacks Middle East Banks","url":"https://web.archive.org/web/20200618235708/https://www.fireeye.com/blog/threat-research/2016/05/targeted_attacksaga.html"}]},{"technique_id":"T1203","description":"OilRig has exploited CVE-2024-30088 to run arbitrary code in the context of SYSTEM.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"}]},{"technique_id":"T1204.001","description":"OilRig has delivered malicious links to achieve execution on the target system.","sources":[{"source":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"},{"source":"Crowdstrike Helix Kitten Nov 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"}]},{"technique_id":"T1204.002","description":"OilRig has delivered macro-enabled documents that required targets to click the \"enable content\" button to execute the payload on the system.","sources":[{"source":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"},{"source":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"},{"source":"Crowdstrike Helix Kitten Nov 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"}]},{"technique_id":"T1218.001","description":"OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.","sources":[]},{"technique_id":"T1219","description":"OilRig has incorporated remote monitoring and management (RMM) tools into their operations including ngrok.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"}]},{"technique_id":"T1497.001","description":"OilRig has used macros to verify if a mouse is connected to a compromised machine.","sources":[{"source":"Check Point APT34 April 2021","url":"https://research.checkpoint.com/2021/irans-apt34-returns-with-an-updated-arsenal/"}]},{"technique_id":"T1505.003","description":"OilRig has used web shells, often to maintain access to a victim network.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1543.003","description":"OilRig has used a compromised Domain Controller to create a service on a remote host.","sources":[{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"technique_id":"T1552.001","description":"OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1553.002","description":"OilRig has signed its malware with stolen certificates.","sources":[]},{"technique_id":"T1555","description":"OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1555.003","description":"OilRig has used credential dumping tools such as LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access. OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"FireEye APT35 2018","url":"https://static.carahsoft.com/concrete/files/1015/2779/3571/M-Trends-2018-Report.pdf"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1555.004","description":"OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"}]},{"technique_id":"T1556.002","description":"OilRig has registered a password filter DLL in order to drop malware.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"}]},{"technique_id":"T1566.001","description":"OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.","sources":[{"source":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"},{"source":"Unit 42 QUADAGENT July 2018","url":"https://researchcenter.paloaltonetworks.com/2018/07/unit42-oilrig-targets-technology-service-provider-government-agency-quadagent/"},{"source":"Crowdstrike Helix Kitten Nov 2018","url":"https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-november-helix-kitten/"}]},{"technique_id":"T1566.002","description":"OilRig has sent spearphising emails with malicious links to potential victims.","sources":[{"source":"Unit 42 OopsIE! Feb 2018","url":"https://researchcenter.paloaltonetworks.com/2018/02/unit42-oopsie-oilrig-uses-threedollars-deliver-new-trojan/"}]},{"technique_id":"T1566.003","description":"OilRig has used LinkedIn to send spearphishing links.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"}]},{"technique_id":"T1572","description":"OilRig has used the Plink utility and other tools to create tunnels to C2 servers.","sources":[{"source":"FireEye APT34 July 2019","url":"https://www.fireeye.com/blog/threat-research/2019/07/hard-pass-declining-apt34-invite-to-join-their-professional-network.html"},{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"},{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"},{"source":"Unit42 OilRig Playbook 2023","url":"https://web.archive.org/web/20230610050742/https://pan-unit42.github.io/playbook_viewer/?pb=evasive-serpens"}]},{"technique_id":"T1573.002","description":"OilRig used the PowerExchange utility and other tools to create tunnels to C2 servers.","sources":[{"source":"FireEye APT34 Webinar Dec 2017","url":"https://www.brighttalk.com/webcast/10703/296317/apt34-new-targeted-attack-in-the-middle-east"}]},{"technique_id":"T1583.001","description":"OilRig has set up fake VPN portals, conference sign ups, and job application websites to target victims.","sources":[]},{"technique_id":"T1586.002","description":"OilRig has compromised email accounts to send phishing emails.","sources":[]},{"technique_id":"T1587.001","description":"OilRig actively developed and used a series of downloaders during 2022.","sources":[{"source":"ESET OilRig Downloaders DEC 2023","url":"https://www.welivesecurity.com/en/eset-research/oilrig-persistent-attacks-cloud-service-powered-downloaders/"}]},{"technique_id":"T1588.002","description":"OilRig has made use of the publicly available tools including Plink and Mimikatz.","sources":[{"source":"Trend Micro Earth Simnavaz October 2024","url":"https://www.trendmicro.com/en_us/research/24/j/earth-simnavaz-cyberattacks.html"},{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]},{"technique_id":"T1588.003","description":"OilRig has obtained stolen code signing certificates to digitally sign malware.","sources":[]},{"technique_id":"T1608.001","description":"OilRig has hosted malware on fake websites designed to target specific audiences.","sources":[]},{"technique_id":"T1686.003","description":"OilRig has modified Windows firewall rules to enable remote access.","sources":[{"source":"Symantec Crambus OCT 2023","url":"https://www.security.com/threat-intelligence/crambus-middle-east-government"}]}]},{"id":"G0071","name":"Orangeworm","procedures":[{"technique_id":"T1021.002","description":"Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.","sources":[{"source":"Symantec Orangeworm April 2018","url":"https://www.symantec.com/blogs/threat-intelligence/orangeworm-targets-healthcare-us-europe-asia"}]},{"technique_id":"T1071.001","description":"Orangeworm has used HTTP for C2.","sources":[{"source":"Symantec Orangeworm IOCs April 2018","url":"https://symantec-enterprise-blogs.security.com/sites/default/files/2018-04/Orangeworm%20IOCs.pdf"}]}]},{"id":"G0040","name":"Patchwork","procedures":[{"technique_id":"T1005","description":"Patchwork collected and exfiltrated files from the infected system.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"}]},{"technique_id":"T1021.001","description":"Patchwork attempted to use RDP to move laterally.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"}]},{"technique_id":"T1027.001","description":"Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1027.002","description":"A Patchwork payload was packed with UPX.","sources":[{"source":"Securelist Dropping Elephant","url":"https://securelist.com/the-dropping-elephant-actor/75328/"}]},{"technique_id":"T1027.005","description":"Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1027.010","description":"Patchwork has obfuscated a script with Crypto Obfuscator.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1033","description":"Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1036.005","description":"Patchwork installed its payload in the startup programs folder as \"Baidu Software Update.\" The group also adds its second stage payload to the startup programs as “Net Monitor.\" They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}]},{"technique_id":"T1053.005","description":"A Patchwork file stealer can run a TaskScheduler DLL to add persistence.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1055.012","description":"A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"}]},{"technique_id":"T1059.001","description":"Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1059.003","description":"Patchwork ran a reverse shell with Meterpreter. Patchwork used JavaScript code and .SCT files on victim machines.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"},{"source":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}]},{"technique_id":"T1059.005","description":"Patchwork used Visual Basic Scripts (VBS) on victim machines.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"},{"source":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}]},{"technique_id":"T1070.004","description":"Patchwork removed certain files and replaced them so they could not be retrieved.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1074.001","description":"Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1082","description":"Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1083","description":"A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1102.001","description":"Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.","sources":[{"source":"Securelist Dropping Elephant","url":"https://securelist.com/the-dropping-elephant-actor/75328/"}]},{"technique_id":"T1105","description":"Patchwork payloads download additional files from the C2 server.","sources":[{"source":"Securelist Dropping Elephant","url":"https://securelist.com/the-dropping-elephant-actor/75328/"},{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1112","description":"A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1119","description":"Patchwork developed a file stealer to search C:\\ and collect files with certain extensions. Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1132.001","description":"Patchwork used Base64 to encode C2 traffic.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"}]},{"technique_id":"T1189","description":"Patchwork has used watering holes to deliver files with exploits to initial victims.","sources":[{"source":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}]},{"technique_id":"T1197","description":"Patchwork has used BITS jobs to download malicious payloads.","sources":[{"source":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}]},{"technique_id":"T1203","description":"Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"},{"source":"Securelist Dropping Elephant","url":"https://securelist.com/the-dropping-elephant-actor/75328/"},{"source":"PaloAlto Patchwork Mar 2018","url":"https://researchcenter.paloaltonetworks.com/2018/03/unit42-patchwork-continues-deliver-badnews-indian-subcontinent/"},{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"},{"source":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}]},{"technique_id":"T1204.001","description":"Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"},{"source":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"},{"source":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}]},{"technique_id":"T1204.002","description":"Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"},{"source":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}]},{"technique_id":"T1518.001","description":"Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"}]},{"technique_id":"T1547.001","description":"Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1548.002","description":"Patchwork bypassed User Access Control (UAC).","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"}]},{"technique_id":"T1553.002","description":"Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.","sources":[{"source":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}]},{"technique_id":"T1555.003","description":"Patchwork dumped the login data database from \\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"}]},{"technique_id":"T1559.002","description":"Patchwork leveraged the DDE protocol to deliver their malware.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1560","description":"Patchwork encrypted the collected files' path with AES and then encoded them with base64.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1566.001","description":"Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source":"Securelist Dropping Elephant","url":"https://securelist.com/the-dropping-elephant-actor/75328/"},{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"},{"source":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}]},{"technique_id":"T1566.002","description":"Patchwork has used spearphishing with links to deliver files with exploits to initial victims.","sources":[{"source":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"},{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1574.001","description":"A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.","sources":[{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]},{"technique_id":"T1587.002","description":"Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.","sources":[{"source":"Unit 42 BackConfig May 2020","url":"https://unit42.paloaltonetworks.com/updated-backconfig-malware-targeting-government-and-military-organizations/"}]},{"technique_id":"T1588.002","description":"Patchwork has obtained and used open-source tools such as QuasarRAT.","sources":[{"source":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}]},{"technique_id":"T1598.003","description":"Patchwork has used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.","sources":[{"source":"Volexity Patchwork June 2018","url":"https://www.volexity.com/blog/2018/06/07/patchwork-apt-group-targets-us-think-tanks/"}]},{"technique_id":"T1680","description":"Patchwork enumerated all available drives on the victim's machine.","sources":[{"source":"Cymmetria Patchwork","url":"https://web.archive.org/web/20180825085952/https:/s3-us-west-2.amazonaws.com/cymmetria-blog/public/Unveiling_Patchwork.pdf"},{"source":"TrendMicro Patchwork Dec 2017","url":"https://documents.trendmicro.com/assets/tech-brief-untangling-the-patchwork-cyberespionage-group.pdf"}]}]},{"id":"G0011","name":"PittyTiger","procedures":[{"technique_id":"T1078","description":"PittyTiger attempts to obtain legitimate credentials during operations.","sources":[{"source":"Bizeul 2014","url":"https://web.archive.org/web/20200921155301/https://airbus-cyber-security.com/the-eye-of-the-tiger/"}]},{"technique_id":"T1588.002","description":"PittyTiger has obtained and used tools such as Mimikatz and gsecdump.","sources":[{"source":"Bizeul 2014","url":"https://web.archive.org/web/20200921155301/https://airbus-cyber-security.com/the-eye-of-the-tiger/"}]}]},{"id":"G0068","name":"PLATINUM","procedures":[{"technique_id":"T1003.001","description":"PLATINUM has used keyloggers that are also capable of dumping credentials.","sources":[{"source":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"technique_id":"T1036","description":"PLATINUM has renamed rar.exe to avoid detection.","sources":[{"source":"Twitter ItsReallyNick Platinum Masquerade","url":"https://x.com/ItsReallyNick/status/1055321868641689600"}]},{"technique_id":"T1055","description":"PLATINUM has used various methods of process injection including hot patching.","sources":[{"source":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"technique_id":"T1056.001","description":"PLATINUM has used several different keyloggers.","sources":[{"source":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"technique_id":"T1056.004","description":"PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.","sources":[{"source":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"technique_id":"T1068","description":"PLATINUM has leveraged a zero-day vulnerability to escalate privileges.","sources":[{"source":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"technique_id":"T1095","description":"PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.","sources":[{"source":"Microsoft PLATINUM June 2017","url":"https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/?source=mmpc"}]},{"technique_id":"T1105","description":"PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.","sources":[{"source":"Microsoft PLATINUM June 2017","url":"https://cloudblogs.microsoft.com/microsoftsecure/2017/06/07/platinum-continues-to-evolve-find-ways-to-maintain-invisibility/?source=mmpc"}]},{"technique_id":"T1189","description":"PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.","sources":[{"source":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"technique_id":"T1204.002","description":"PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.","sources":[{"source":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]},{"technique_id":"T1566.001","description":"PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.","sources":[{"source":"Microsoft PLATINUM April 2016","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf"}]}]},{"id":"G1040","name":"Play","procedures":[{"technique_id":"T1003.001","description":"Play has used Mimikatz and the Windows Task Manager to dump LSASS process memory.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1016","description":"Play has used the information-stealing tool Grixba to enumerate network information.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"}]},{"technique_id":"T1018","description":"Play has used tools such as AdFind, Nltest, and BloodHound to enumerate shares and hostnames on compromised networks.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1021.002","description":"Play has used Cobalt Strike to move laterally via SMB.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1027.010","description":"Play has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1030","description":"Play has split victims' files into chunks for exfiltration.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1048","description":"Play has used WinSCP to exfiltrate data to actor-controlled accounts.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1057","description":"Play has used the information stealer Grixba to check for a list of security processes.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1059.001","description":"Play has used Base64-encoded PowerShell scripts to disable Microsoft Defender.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1059.003","description":"Play has used a batch script to remove indicators of its presence on compromised hosts.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1070.004","description":"Play has used tools including Wevtutil to remove malicious files from compromised hosts.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1078","description":"Play has used valid VPN accounts to achieve initial access.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"}]},{"technique_id":"T1078.002","description":"Play has used valid domain accounts for access.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1078.003","description":"Play has used valid local accounts to gain initial access.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1082","description":"Play has leveraged tools to enumerate system information.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1083","description":"Play has used the Grixba information stealer to list security files and processes.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1105","description":"Play has used Cobalt Strike to download files to compromised machines.","sources":[{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1133","description":"Play has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1190","description":"Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 (\"ProxyNotShell\") in Microsoft Exchange.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1518.001","description":"Play has used the information-stealing tool Grixba to scan for anti-virus software.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"}]},{"technique_id":"T1560.001","description":"Play has used WinRAR to compress files prior to exfiltration.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1587.001","description":"Play developed and employ Playcrypt ransomware.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1588.002","description":"Play has used multiple tools for discovery and defense evasion purposes on compromised hosts.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"}]},{"technique_id":"T1657","description":"Play demands ransom payments from victims to unencrypt filesystems and to not publish sensitive data exfiltrated from victim networks.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"}]},{"technique_id":"T1685","description":"Play has used tools including GMER, IOBit, and PowerTool to disable antivirus software.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]},{"technique_id":"T1685.005","description":"Play has used tools to remove log files on targeted systems.","sources":[{"source":"CISA Play Ransomware Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"},{"source":"Trend Micro Ransomware Spotlight Play July 2023","url":"https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"}]}]},{"id":"G1005","name":"POLONIUM","procedures":[{"technique_id":"T1078","description":"POLONIUM has used valid compromised credentials to gain access to victim environments.","sources":[{"source":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"technique_id":"T1090","description":"POLONIUM has used the AirVPN service for operational activity.","sources":[{"source":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"technique_id":"T1102.002","description":"POLONIUM has used OneDrive and DropBox for C2.","sources":[{"source":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"technique_id":"T1199","description":"POLONIUM has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.","sources":[{"source":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"technique_id":"T1567.002","description":"POLONIUM has exfiltrated stolen data to POLONIUM-owned OneDrive and Dropbox accounts.","sources":[{"source":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"technique_id":"T1583.006","description":"POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations.","sources":[{"source":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]},{"technique_id":"T1588.002","description":"POLONIUM has obtained and used tools such as AirVPN and plink in their operations.","sources":[{"source":"Microsoft POLONIUM June 2022","url":"https://www.microsoft.com/security/blog/2022/06/02/exposing-polonium-activity-and-infrastructure-targeting-israeli-organizations/"}]}]},{"id":"G0033","name":"Poseidon Group","procedures":[{"technique_id":"T1003","description":"Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.","sources":[{"source":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}]},{"technique_id":"T1007","description":"After compromising a victim, Poseidon Group discovers all running services.","sources":[{"source":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}]},{"technique_id":"T1036.005","description":"Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.","sources":[{"source":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}]},{"technique_id":"T1049","description":"Poseidon Group obtains and saves information about victim network interfaces and addresses.","sources":[{"source":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}]},{"technique_id":"T1057","description":"After compromising a victim, Poseidon Group lists all running processes.","sources":[{"source":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}]},{"technique_id":"T1059.001","description":"The Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components.","sources":[{"source":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}]},{"technique_id":"T1087.001","description":"Poseidon Group searches for administrator accounts on both the local victim machine and the network.","sources":[{"source":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}]},{"technique_id":"T1087.002","description":"Poseidon Group searches for administrator accounts on both the local victim machine and the network.","sources":[{"source":"Kaspersky Poseidon Group","url":"https://securelist.com/poseidon-group-a-targeted-attack-boutique-specializing-in-global-cyber-espionage/73673/"}]}]},{"id":"G0056","name":"PROMETHIUM","procedures":[{"technique_id":"T1036.004","description":"PROMETHIUM has named services to appear legitimate.","sources":[{"source":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"},{"source":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}]},{"technique_id":"T1036.005","description":"PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.","sources":[{"source":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"},{"source":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}]},{"technique_id":"T1078.003","description":"PROMETHIUM has created admin accounts on a compromised host.","sources":[{"source":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}]},{"technique_id":"T1189","description":"PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.","sources":[{"source":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}]},{"technique_id":"T1204.002","description":"PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.","sources":[{"source":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"},{"source":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}]},{"technique_id":"T1205.001","description":"PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.","sources":[{"source":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}]},{"technique_id":"T1543.003","description":"PROMETHIUM has created new services and modified existing services for persistence.","sources":[{"source":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}]},{"technique_id":"T1547.001","description":"PROMETHIUM has used Registry run keys to establish persistence.","sources":[{"source":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"}]},{"technique_id":"T1553.002","description":"PROMETHIUM has signed code with self-signed certificates.","sources":[{"source":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}]},{"technique_id":"T1587.002","description":"PROMETHIUM has created self-signed certificates to sign malicious installers.","sources":[{"source":"Bitdefender StrongPity June 2020","url":"https://www.bitdefender.com/files/News/CaseStudies/study/353/Bitdefender-Whitepaper-StrongPity-APT.pdf"}]},{"technique_id":"T1587.003","description":"PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.","sources":[{"source":"Talos Promethium June 2020","url":"https://blog.talosintelligence.com/2020/06/promethium-extends-with-strongpity3.html"}]}]},{"id":"G0024","name":"Putter Panda","procedures":[{"technique_id":"T1027.013","description":"Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.","sources":[]},{"technique_id":"T1055.001","description":"An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).","sources":[]},{"technique_id":"T1547.001","description":"A dropper used by Putter Panda installs itself into the ASEP Registry key HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run with a value named McUpdate.","sources":[]},{"technique_id":"T1685","description":"Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).","sources":[]}]},{"id":"G0075","name":"Rancor","procedures":[{"technique_id":"T1053.005","description":"Rancor launched a scheduled task to gain persistence using the schtasks /create /sc command.","sources":[{"source":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"technique_id":"T1059.003","description":"Rancor has used cmd.exe to execute commmands.","sources":[{"source":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"technique_id":"T1059.005","description":"Rancor has used VBS scripts as well as embedded macros for execution.","sources":[{"source":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"technique_id":"T1071.001","description":"Rancor has used HTTP for C2.","sources":[{"source":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"technique_id":"T1105","description":"Rancor has downloaded additional malware, including by using certutil.","sources":[{"source":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"technique_id":"T1204.002","description":"Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.","sources":[{"source":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"technique_id":"T1218.007","description":"Rancor has used msiexec to download and execute malicious installer files over HTTP.","sources":[{"source":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]},{"technique_id":"T1546.003","description":"Rancor has complied VBScript-generated MOF files into WMI event subscriptions for persistence.","sources":[{"source":"Rancor WMI","url":"https://unit42.paloaltonetworks.com/rancor-cyber-espionage-group-uses-new-custom-malware-to-attack-southeast-asia/"}]},{"technique_id":"T1566.001","description":"Rancor has attached a malicious document to an email to gain initial access.","sources":[{"source":"Rancor Unit42 June 2018","url":"https://researchcenter.paloaltonetworks.com/2018/06/unit42-rancor-targeted-attacks-south-east-asia-using-plaintee-ddkong-malware-families/"}]}]},{"id":"G1039","name":"RedCurl","procedures":[{"technique_id":"T1003.001","description":"RedCurl used LaZagne to obtain passwords from memory.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1005","description":"RedCurl has collected data from the local disk of compromised hosts.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1020","description":"RedCurl has used batch scripts to exfiltrate data.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1027","description":"RedCurl has used malware with string encryption. RedCurl has also encrypted data and has encoded PowerShell commands using Base64. RedCurl has used PyArmor to obfuscate code execution of LaZagne. Additionally, RedCurl has obfuscated downloaded files by renaming them as commonly used tools and has used echo, instead of file names themselves, to execute files.","sources":[{"source":"therecord_redcurl","url":"https://therecord.media/redcurl-hackers-russian-bank-australian-company"},{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"},{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1036.005","description":"RedCurl mimicked legitimate file names and scheduled tasks, e.g. MicrosoftCurrentupdatesCheck and MdMMaintenenceTask to mask malicious files and scheduled tasks.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1039","description":"RedCurl has collected data about network drives.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1046","description":"RedCurl has used netstat to check if port 4119 is open.","sources":[{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1053.005","description":"RedCurl has created scheduled tasks for persistence.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"},{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1056.002","description":"RedCurl prompts the user for credentials through a Microsoft Outlook pop-up.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1059.001","description":"RedCurl has used PowerShell to execute commands and to download malware.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"},{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1059.003","description":"RedCurl has used the Windows Command Prompt to execute commands.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"},{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1059.005","description":"RedCurl has used VBScript to run malicious files.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1059.006","description":"RedCurl has used a Python script to establish outbound communication and to execute commands using SMB port 445.","sources":[{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1070.004","description":"RedCurl has deleted files after execution.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"},{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1071.001","description":"RedCurl has used HTTP, HTTPS and Webdav protocls for C2 communications.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1080","description":"RedCurl has placed modified LNK files on network drives for lateral movement.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1082","description":"RedCurl has collected information about the target system, such as system information and list of network connections.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1083","description":"RedCurl has searched for and collected files on local and network drives.","sources":[{"source":"therecord_redcurl","url":"https://therecord.media/redcurl-hackers-russian-bank-australian-company"},{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1087.001","description":"RedCurl has collected information about local accounts.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1087.002","description":"RedCurl has collected information about domain accounts using SysInternal’s AdExplorer functionality .","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1087.003","description":"RedCurl has collected information about email accounts.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1102","description":"RedCurl has used web services to download malicious files.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1114.001","description":"RedCurl has collected emails to use in future phishing campaigns.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"}]},{"technique_id":"T1119","description":"RedCurl has used batch scripts to collect data.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1199","description":"RedCurl has gained access to a contractor to pivot to the victim’s infrastructure.","sources":[{"source":"therecord_redcurl","url":"https://therecord.media/redcurl-hackers-russian-bank-australian-company"}]},{"technique_id":"T1202","description":"RedCurl has used pcalua.exe to obfuscate binary execution and remote connections.","sources":[{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1204.001","description":"RedCurl has used malicious links to infect the victim machines.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1204.002","description":"RedCurl has used malicious files to infect the victim machines.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"},{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1218.011","description":"RedCurl has used rundll32.exe to execute malicious files.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"},{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1537","description":"RedCurl has used cloud storage to exfiltrate data, in particular the megatools utilities were used to exfiltrate data to Mega, a file storage service.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1547.001","description":"RedCurl has established persistence by creating entries in HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1552.001","description":"RedCurl used LaZagne to obtain passwords in files.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1552.002","description":"RedCurl used LaZagne to obtain passwords in the Registry.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1555.003","description":"RedCurl used LaZagne to obtain passwords from web browsers.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1560.001","description":"RedCurl has downloaded 7-Zip to decompress password protected archives.","sources":[{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1564.001","description":"RedCurl added the “hidden” file attribute to original files, manipulating victims to click on malicious LNK files.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1566.001","description":"RedCurl has used phishing emails with malicious files to gain initial access.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"trendmicro_redcurl","url":"https://www.trendmicro.com/en_us/research/24/c/unveiling-earth-kapre-aka-redcurls-cyberespionage-tactics-with-t.html"}]},{"technique_id":"T1566.002","description":"RedCurl has used phishing emails with malicious links to gain initial access.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1573.001","description":"RedCurl has used AES-128 CBC to encrypt C2 communications.","sources":[{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1573.002","description":"RedCurl has used HTTPS for C2 communication.","sources":[{"source":"group-ib_redcurl1","url":"https://www.group-ib.com/resources/research-hub/red-curl/"},{"source":"group-ib_redcurl2","url":"https://www.group-ib.com/resources/research-hub/red-curl-2/"}]},{"technique_id":"T1587.001","description":"RedCurl has created its own tools to use during operations.","sources":[{"source":"therecord_redcurl","url":"https://therecord.media/redcurl-hackers-russian-bank-australian-company"}]}]},{"id":"G1042","name":"RedEcho","procedures":[{"technique_id":"T1071.001","description":"RedEcho network activity is associated with SSL traffic via TCP 443 and proxied HTTP traffic over non-standard ports.","sources":[{"source":"RecordedFuture RedEcho 2021","url":"https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf"}]},{"technique_id":"T1568","description":"RedEcho used dynamic DNS domains associated with malicious infrastructure.","sources":[{"source":"RecordedFuture RedEcho 2021","url":"https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf"}]},{"technique_id":"T1571","description":"RedEcho has used non-standard ports such as TCP 8080 for HTTP communication.","sources":[{"source":"RecordedFuture RedEcho 2021","url":"https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf"}]},{"technique_id":"T1573.002","description":"RedEcho uses SSL for network communication.","sources":[{"source":"RecordedFuture RedEcho 2021","url":"https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf"}]},{"technique_id":"T1583.001","description":"RedEcho has registered domains spoofing Indian critical infrastructure entities.","sources":[{"source":"RecordedFuture RedEcho 2021","url":"https://go.recordedfuture.com/hubfs/reports/cta-2021-0228.pdf"}]}]},{"id":"G0106","name":"Rocke","procedures":[{"technique_id":"T1014","description":"Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1018","description":"Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"technique_id":"T1021.004","description":"Rocke has spread its coinminer via SSH.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1027","description":"Rocke has modified UPX headers after packing files to break unpackers.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1027.002","description":"Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source":"Unit 42 Rocke January 2019","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"},{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1027.004","description":"Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1036.005","description":"Rocke has used shell scripts which download mining executables and saves them with the filename \"java\".","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"technique_id":"T1037","description":"Rocke has installed an \"init.d\" startup script to maintain persistence.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1046","description":"Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1053.003","description":"Rocke installed a cron job that downloaded and executed files from the C2.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source":"Unit 42 Rocke January 2019","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"},{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1055.002","description":"Rocke's miner, \"TermsHost.exe\", evaded defenses by injecting itself into Windows processes, including Notepad.exe.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"technique_id":"T1057","description":"Rocke can detect a running process's PID on the infected machine.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1059.004","description":"Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"technique_id":"T1059.006","description":"Rocke has used Python-based malware to install and spread their coinminer.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1070.004","description":"Rocke has deleted files on infected machines.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1070.006","description":"Rocke has changed the time stamp of certain files.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1071","description":"Rocke issued wget requests from infected systems to the C2.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"technique_id":"T1071.001","description":"Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1082","description":"Rocke has used uname -m to collect the name and information about the infected system's kernel.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1102","description":"Rocke has used Pastebin, Gitee, and GitLab for Command and Control.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"},{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"technique_id":"T1102.001","description":"Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1105","description":"Rocke used malware to download additional malicious files to the target system.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"technique_id":"T1140","description":"Rocke has extracted tar.gz files after downloading them from a C2 server.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"technique_id":"T1190","description":"Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source":"Unit 42 Rocke January 2019","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"}]},{"technique_id":"T1222.002","description":"Rocke has changed file permissions of files so they could not be modified.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1496.001","description":"Rocke has distributed cryptomining malware.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source":"Unit 42 Rocke January 2019","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"}]},{"technique_id":"T1518.001","description":"Rocke used scripts which detected and uninstalled antivirus software.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source":"Unit 42 Rocke January 2019","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"}]},{"technique_id":"T1543.002","description":"Rocke has installed a systemd service script to maintain persistence.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1547.001","description":"Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]},{"technique_id":"T1552.004","description":"Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1564.001","description":"Rocke downloaded a file \"libprocesshider\", which could hide files on the target system.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source":"Unit 42 Rocke January 2019","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"}]},{"technique_id":"T1571","description":"Rocke's miner connects to a C2 server using port 51640.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1574.006","description":"Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1685","description":"Rocke used scripts which detected and uninstalled antivirus software.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"},{"source":"Unit 42 Rocke January 2019","url":"https://unit42.paloaltonetworks.com/malware-used-by-rocke-group-evolves-to-evade-detection-by-cloud-security-products/"}]},{"technique_id":"T1685.006","description":"Rocke has cleared log files within the /var/log/ folder.","sources":[{"source":"Anomali Rocke March 2019","url":"https://www.anomali.com/blog/rocke-evolves-its-arsenal-with-a-new-malware-family-written-in-golang"}]},{"technique_id":"T1686","description":"Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.","sources":[{"source":"Talos Rocke August 2018","url":"https://blog.talosintelligence.com/2018/08/rocke-champion-of-monero-miners.html"}]}]},{"id":"G0048","name":"RTM","procedures":[{"technique_id":"T1102.001","description":"RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names.","sources":[{"source":"ESET RTM Feb 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"}]},{"technique_id":"T1189","description":"RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network Yandex.Direct.","sources":[{"source":"ESET RTM Feb 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"},{"source":"ESET Buhtrap and Buran April 2019","url":"https://www.welivesecurity.com/2019/04/30/buhtrap-backdoor-ransomware-advertising-platform/"}]},{"technique_id":"T1204.002","description":"RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.","sources":[{"source":"Group IB RTM August 2019","url":"https://www.group-ib.com/blog/rtm"}]},{"technique_id":"T1219.002","description":"RTM has used a modified version of TeamViewer and Remote Utilities for remote access.","sources":[{"source":"Group IB RTM August 2019","url":"https://www.group-ib.com/blog/rtm"}]},{"technique_id":"T1547.001","description":"RTM has used Registry run keys to establish persistence for the RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.","sources":[{"source":"ESET RTM Feb 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/02/Read-The-Manual.pdf"},{"source":"Group IB RTM August 2019","url":"https://www.group-ib.com/blog/rtm"}]},{"technique_id":"T1566.001","description":"RTM has used spearphishing attachments to distribute its malware.","sources":[{"source":"Group IB RTM August 2019","url":"https://www.group-ib.com/blog/rtm"}]},{"technique_id":"T1574.001","description":"RTM has used search order hijacking to force TeamViewer to load a malicious DLL.","sources":[{"source":"Group IB RTM August 2019","url":"https://www.group-ib.com/blog/rtm"}]}]},{"id":"G1031","name":"Saint Bear","procedures":[{"technique_id":"T1027.002","description":"Saint Bear clones .NET assemblies from other .NET binaries as well as cloning code signing certificates from other software to obfuscate the initial loader payload.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1027.013","description":"Saint Bear initial payloads included encoded follow-on payloads located in the resources file of the first-stage loader.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1059","description":"Saint Bear has used the Windows Script Host (wscript) to execute intermediate files written to victim machines.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1059.001","description":"Saint Bear relies extensively on PowerShell execution from malicious attachments and related content to retrieve and execute follow-on payloads.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1059.003","description":"Saint Bear initial loaders will also drop a malicious Windows batch file, available via open source GitHub repositories, that disables Microsoft Defender functionality.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1059.007","description":"Saint Bear has delivered malicious Microsoft Office files containing an embedded JavaScript object that would, on execution, download and execute OutSteel and Saint Bot.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1112","description":"Saint Bear will leverage malicious Windows batch scripts to modify registry values associated with Windows Defender functionality.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1203","description":"Saint Bear has leveraged vulnerabilities in client applications such as CVE-2017-11882 in Microsoft Office to enable code execution in victim environments.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1204.001","description":"Saint Bear has, in addition to email-based phishing attachments, used malicious websites masquerading as legitimate entities to host links to malicious files for user execution.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"},{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1204.002","description":"Saint Bear relies on user interaction and execution of malicious attachments and similar for initial execution on victim systems.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1497","description":"Saint Bear contains several anti-analysis and anti-virtualization checks.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1553.002","description":"Saint Bear has used an initial loader malware featuring a legitimate code signing certificate associated with \"Electrum Technologies GmbH.\"","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1566.001","description":"Saint Bear uses a variety of file formats, such as Microsoft Office documents, ZIP archives, PDF documents, and other items as phishing attachments for initial access.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1583.006","description":"Saint Bear has leveraged the Discord content delivery network to host malicious content for retrieval during initial access operations.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1589.002","description":"Saint Bear gathered victim email information in advance of phishing operations for targeted attacks.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1608.001","description":"Saint Bear has used the Discord content delivery network for hosting malicious content referenced in links and emails.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]},{"technique_id":"T1684.001","description":"Saint Bear has impersonated government and related entities in both phishing activity and developing web sites with malicious links that mimic legitimate resources.","sources":[{"source":"Cadet Blizzard emerges as novel threat actor","url":"https://www.microsoft.com/en-us/security/blog/2023/06/14/cadet-blizzard-emerges-as-a-novel-and-distinct-russian-threat-actor/"}]},{"technique_id":"T1685","description":"Saint Bear will modify registry entries and scheduled task objects associated with Windows Defender to disable its functionality.","sources":[{"source":"Palo Alto Unit 42 OutSteel SaintBot February 2022 ","url":"https://unit42.paloaltonetworks.com/ukraine-targeted-outsteel-saintbot/"}]}]},{"id":"G1045","name":"Salt Typhoon","procedures":[{"technique_id":"T1021.004","description":"Salt Typhoon has modified the loopback address on compromised switches and used them as the source of SSH connections to additional devices within the target environment, allowing them to bypass access control lists (ACLs).","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1040","description":"Salt Typhoon has used a variety of tools and techniques to capture packet data between network interfaces.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1048.003","description":"Salt Typhoon has exfiltrated configuration files from exploited network devices over FTP and TFTP.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1098.004","description":"Salt Typhoon has added SSH authorized_keys under root or other users at the Linux level on compromised network devices.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1110.002","description":"Salt Typhoon has cracked passwords for accounts with weak encryption obtained from the configuration files of compromised network devices.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1136","description":"Salt Typhoon has created Linux-level users on compromised network devices through modification of /etc/shadow and /etc/passwd.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1190","description":"Salt Typhoon has exploited CVE-2018-0171 in the Smart Install feature of Cisco IOS and Cisco IOS XE software for initial access.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1572","description":"Salt Typhoon has modified device configurations to create and use Generic Routing Encapsulation (GRE) tunnels.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1587.001","description":"Salt Typhoon has used custom tooling including JumbledPath.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1588.002","description":"Salt Typhoon has used publicly available tooling to exploit vulnerabilities.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1590.004","description":"Salt Typhoon has used configuration files from exploited network devices to help discover upstream and downstream network segments.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1602.002","description":"Salt Typhoon has attempted to acquire credentials by dumping network device configurations.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1685.006","description":"Salt Typhoon has cleared logs including .bash_history, auth.log, lastlog, wtmp, and btmp.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]},{"technique_id":"T1686","description":"Salt Typhoon has made changes to the Access Control List (ACL) and loopback interface address on compromised devices.","sources":[{"source":"Cisco Salt Typhoon FEB 2025","url":"https://blog.talosintelligence.com/salt-typhoon-analysis/"}]}]},{"id":"G0034","name":"Sandworm Team","procedures":[{"technique_id":"T1003.001","description":"Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source":"ESET Telebots June 2017","url":"https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/"},{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"technique_id":"T1003.003","description":"Sandworm Team has used ntdsutil.exe to back up the Active Directory database, likely for credential access.","sources":[{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"technique_id":"T1005","description":"Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1018","description":"Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"}]},{"technique_id":"T1021.002","description":"Sandworm Team has copied payloads to the ADMIN$ share of remote systems and run net use to connect to network shares.","sources":[{"source":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"},{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"technique_id":"T1027","description":"Sandworm Team has used Base64 encoding within malware variants.","sources":[{"source":"iSight Sandworm Oct 2014","url":"https://web.archive.org/web/20160503234007/https:/www.isightpartners.com/2014/10/cve-2014-4114/"}]},{"technique_id":"T1027.010","description":"Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}]},{"technique_id":"T1033","description":"Sandworm Team has collected the username from a compromised host.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1036","description":"Sandworm Team masqueraded malicious installers as Windows update packages to evade defense and entice users to execute binaries.","sources":[{"source":"Leonard TAG 2023","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"}]},{"technique_id":"T1036.005","description":"Sandworm Team has avoided detection by naming a malicious binary explorer.exe.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1040","description":"Sandworm Team has used intercepter-NG to sniff passwords in network traffic.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}]},{"technique_id":"T1041","description":"Sandworm Team has sent system information to its C2 server using HTTP.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}]},{"technique_id":"T1047","description":"Sandworm Team has used Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.","sources":[{"source":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"},{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"technique_id":"T1049","description":"Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.","sources":[{"source":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1053.005","description":"Sandworm Team leveraged SHARPIVORY, a .NET dropper that writes embedded payload to disk and uses scheduled tasks to persist on victim machines.","sources":[{"source":"mandiant_apt44_unearthing_sandworm","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"}]},{"technique_id":"T1056.001","description":"Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}]},{"technique_id":"T1059.001","description":"Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.","sources":[{"source":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1059.005","description":"Sandworm Team has created VBScripts to run an SSH server.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source":"ESET BlackEnergy Jan 2016","url":"https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"},{"source":"ESET Telebots June 2017","url":"https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/"},{"source":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"}]},{"technique_id":"T1070.004","description":"Sandworm Team has used backdoors that can delete files used in an attack from an infected system.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source":"ESET Telebots July 2017","url":"https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"},{"source":"Mandiant-Sandworm-Ukraine-2022","url":"https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"}]},{"technique_id":"T1071.001","description":"Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}]},{"technique_id":"T1072","description":"Sandworm Team has used the commercially available tool RemoteExec for agentless remote code execution.","sources":[{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"technique_id":"T1078","description":"Sandworm Team have used previously acquired legitimate credentials prior to attacks.","sources":[{"source":"US-CERT Ukraine Feb 2016","url":"https://www.us-cert.gov/ics/alerts/IR-ALERT-H-16-056-01"}]},{"technique_id":"T1078.002","description":"Sandworm Team has used stolen credentials to access administrative accounts within the domain.","sources":[{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1082","description":"Sandworm Team used a backdoor to enumerate information about the infected system's operating system.","sources":[{"source":"ESET Telebots July 2017","url":"https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1083","description":"Sandworm Team has enumerated files on a compromised host.","sources":[{"source":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1087.002","description":"Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}]},{"technique_id":"T1087.003","description":"Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.","sources":[{"source":"ESET Telebots July 2017","url":"https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"}]},{"technique_id":"T1090","description":"Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}]},{"technique_id":"T1102.002","description":"Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source":"ESET Telebots June 2017","url":"https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/"}]},{"technique_id":"T1105","description":"Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1106","description":"Sandworm Team uses Prestige to disable and restore file system redirection by using the following functions: Wow64DisableWow64FsRedirection() and Wow64RevertWow64FsRedirection().","sources":[{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"technique_id":"T1132.001","description":"Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}]},{"technique_id":"T1133","description":"Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.","sources":[{"source":"ANSSI Sandworm January 2021","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"},{"source":"ESET BlackEnergy Jan 2016","url":"https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"},{"source":"ESET Telebots June 2017","url":"https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/"},{"source":"mandiant_apt44_unearthing_sandworm","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"}]},{"technique_id":"T1140","description":"Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source":"ESET Telebots July 2017","url":"https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"}]},{"technique_id":"T1190","description":"Sandworm Team exploits public-facing applications for initial access and to acquire infrastructure, such as exploitation of the EXIM mail transfer agent in Linux systems.","sources":[{"source":"Leonard TAG 2023","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"},{"source":"NSA Sandworm 2020","url":"https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"}]},{"technique_id":"T1195","description":"Sandworm Team staged compromised versions of legitimate software installers on forums to achieve initial, untargetetd access in victim environments.","sources":[{"source":"mandiant_apt44_unearthing_sandworm","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"}]},{"technique_id":"T1195.002","description":"Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.","sources":[{"source":"ESET Telebots June 2017","url":"https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/"},{"source":"Secureworks NotPetya June 2017","url":"https://www.secureworks.com/blog/notpetya-campaign-what-we-know-about-the-latest-global-ransomware-attack"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1199","description":"Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization. Additionally, Sandworm Team has accessed Internet service providers and telecommunication entities that provide mobile connectivity.","sources":[{"source":"mandiant_apt44_unearthing_sandworm","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1203","description":"Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).","sources":[{"source":"McAfee Sandworm November 2013","url":"https://www.mcafee.com/blogs/other-blogs/mcafee-labs-detects-zero-day-exploit-targeting-microsoft-office-2"},{"source":"iSight Sandworm Oct 2014","url":"https://web.archive.org/web/20160503234007/https:/www.isightpartners.com/2014/10/cve-2014-4114/"},{"source":"TrendMicro Sandworm October 2014","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/an-analysis-of-windows-zero-day-vulnerability-cve-2014-4114-aka-sandworm/"}]},{"technique_id":"T1204.001","description":"Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1204.002","description":"Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1213.006","description":"Sandworm Team exfiltrates data of interest from enterprise databases using Adminer.","sources":[{"source":"Leonard TAG 2023","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"}]},{"technique_id":"T1218.011","description":"Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.","sources":[{"source":"ESET Telebots July 2017","url":"https://www.welivesecurity.com/2017/07/04/analysis-of-telebots-cunning-backdoor/"}]},{"technique_id":"T1219","description":"Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.","sources":[{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"},{"source":"US-CERT Ukraine Feb 2016","url":"https://www.us-cert.gov/ics/alerts/IR-ALERT-H-16-056-01"}]},{"technique_id":"T1485","description":"Sandworm Team has used CaddyWiper, SDelete, and the BlackEnergy KillDisk component to overwrite files on victim systems. Additionally, Sandworm Team has used the JUNKMAIL tool to overwrite files with null bytes.","sources":[{"source":"ESET Telebots June 2017","url":"https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/"},{"source":"Mandiant-Sandworm-Ukraine-2022","url":"https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"},{"source":"mandiant_apt44_unearthing_sandworm","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"},{"source":"US-CERT Ukraine Feb 2016","url":"https://www.us-cert.gov/ics/alerts/IR-ALERT-H-16-056-01"}]},{"technique_id":"T1486","description":"Sandworm Team has used Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.","sources":[{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"technique_id":"T1489","description":"Sandworm Team attempts to stop the MSSQL Windows service to ensure successful encryption of locked files.","sources":[{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"technique_id":"T1490","description":"Sandworm Team uses Prestige to delete the backup catalog from the target system using: C:\\Windows\\System32\\wbadmin.exe delete catalog -quiet and to delete volume shadow copies using: C:\\Windows\\System32\\vssadmin.exe delete shadows /all /quiet.","sources":[{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"technique_id":"T1491.002","description":"Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"},{"source":"UK NCSC Olympic Attacks October 2020","url":"https://www.gov.uk/government/news/uk-exposes-series-of-russian-cyber-attacks-against-olympic-and-paralympic-games"}]},{"technique_id":"T1499","description":"Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1505.003","description":"Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.","sources":[{"source":"ANSSI Sandworm January 2021","url":"https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf"}]},{"technique_id":"T1539","description":"Sandworm Team used information stealer malware to collect browser session cookies.","sources":[{"source":"Leonard TAG 2023","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"}]},{"technique_id":"T1555.003","description":"Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"}]},{"technique_id":"T1561.002","description":"Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.","sources":[{"source":"US-CERT Ukraine Feb 2016","url":"https://www.us-cert.gov/ics/alerts/IR-ALERT-H-16-056-01"},{"source":"ESET Telebots June 2017","url":"https://www.welivesecurity.com/2017/06/30/telebots-back-supply-chain-attacks-against-ukraine/"}]},{"technique_id":"T1566.001","description":"Sandworm Team has delivered malicious Microsoft Office and ZIP file attachments via spearphishing emails.","sources":[{"source":"ESET Telebots Dec 2016","url":"https://www.welivesecurity.com/2016/12/13/rise-telebots-analyzing-disruptive-killdisk-attacks/"},{"source":"Google_WinRAR_vuln_2023","url":"https://blog.google/threat-analysis-group/government-backed-actors-exploiting-winrar-vulnerability/"},{"source":"mandiant_apt44_unearthing_sandworm","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"},{"source":"US-CERT Ukraine Feb 2016","url":"https://www.us-cert.gov/ics/alerts/IR-ALERT-H-16-056-01"},{"source":"iSight Sandworm Oct 2014","url":"https://web.archive.org/web/20160503234007/https:/www.isightpartners.com/2014/10/cve-2014-4114/"}]},{"technique_id":"T1566.002","description":"Sandworm Team has crafted phishing emails containing malicious hyperlinks.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1570","description":"Sandworm Team has used move to transfer files to a network share and has copied payloads--such as Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object. Additionally, Sandworm Team has transferred an ISO file into the OT network to gain initial access.","sources":[{"source":"Dragos Crashoverride 2018","url":"https://www.dragos.com/wp-content/uploads/CRASHOVERRIDE2018.pdf"},{"source":"Mandiant-Sandworm-Ukraine-2022","url":"https://www.mandiant.com/resources/blog/sandworm-disrupts-power-ukraine-operational-technology"},{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"}]},{"technique_id":"T1571","description":"Sandworm Team has used port 6789 to accept connections on the group's SSH server.","sources":[{"source":"ESET BlackEnergy Jan 2016","url":"https://www.welivesecurity.com/2016/01/03/blackenergy-sshbeardoor-details-2015-attacks-ukrainian-news-media-electric-industry/"}]},{"technique_id":"T1583","description":"Sandworm Team used various third-party email campaign management services to deliver phishing emails.","sources":[{"source":"Leonard TAG 2023","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"}]},{"technique_id":"T1583.001","description":"Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages, while also hosting these items on legitimate, compromised network infrastructure.","sources":[{"source":"Slowik Sandworm 2021","url":"https://www.domaintools.com/resources/blog/centreon-to-exim-and-back-on-the-trail-of-sandworm/"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1583.004","description":"Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1584.004","description":"Sandworm Team compromised legitimate Linux servers running the EXIM mail transfer agent for use in subsequent campaigns.","sources":[{"source":"Leonard TAG 2023","url":"https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"},{"source":"NSA Sandworm 2020","url":"https://media.defense.gov/2020/May/28/2002306626/-1/-1/0/CSA%20Sandworm%20Actors%20Exploiting%20Vulnerability%20in%20Exim%20Transfer%20Agent%2020200528.pdf"}]},{"technique_id":"T1584.005","description":"Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.","sources":[{"source":"NCSC Cyclops Blink February 2022","url":"https://www.ncsc.gov.uk/files/Cyclops-Blink-Malware-Analysis-Report.pdf"}]},{"technique_id":"T1585.001","description":"Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1585.002","description":"Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1586.001","description":"Sandworm Team creates credential capture webpages to compromise existing, legitimate social media accounts.","sources":[{"source":"Slowik Sandworm 2021","url":"https://www.domaintools.com/resources/blog/centreon-to-exim-and-back-on-the-trail-of-sandworm/"}]},{"technique_id":"T1587.001","description":"Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1588.002","description":"Sandworm Team has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations. Additionally, Sandworm Team has used Empire, Cobalt Strike and PoshC2.","sources":[{"source":"Microsoft Prestige ransomware October 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/10/14/new-prestige-ransomware-impacts-organizations-in-ukraine-and-poland/"},{"source":"mandiant_apt44_unearthing_sandworm","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"},{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1588.006","description":"In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1589.002","description":"Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1589.003","description":"Sandworm Team's research of potential victim organizations included the identification and collection of employee information.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1590.001","description":"Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1591.002","description":"In preparation for its attack against the 2018 Winter Olympics, Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1592.002","description":"Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1593","description":"Sandworm Team researched Ukraine's unique legal entity identifier (called an \"EDRPOU\" number), including running queries on the EDRPOU website, in preparation for the NotPetya attack. Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1594","description":"Sandworm Team has conducted research against potential victim websites as part of its operational planning.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1595.002","description":"Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1598.003","description":"Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.","sources":[{"source":"US District Court Indictment GRU Unit 74455 October 2020","url":"https://www.justice.gov/opa/press-release/file/1328521/download"}]},{"technique_id":"T1608.001","description":"Sandworm Team staged compromised versions of legitimate software installers in forums to enable initial access to executing user.","sources":[{"source":"mandiant_apt44_unearthing_sandworm","url":"https://services.google.com/fh/files/misc/apt44-unearthing-sandworm.pdf"}]}]},{"id":"G0029","name":"Scarlet Mimic","procedures":[{"technique_id":"T1036.002","description":"Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.","sources":[]}]},{"id":"G1015","name":"Scattered Spider","procedures":[{"technique_id":"T1003.003","description":"Scattered Spider has extracted the NTDS.dit file by creating volume shadow copies of virtual domain controller disks.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1006","description":"Scattered Spider has created volume shadow copies of virtual domain controller disks to extract the NTDS.dit file.","sources":[{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1016","description":"Scattered Spider has used network reconnaissance commands for discovery including ping and nltest.","sources":[{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}]},{"technique_id":"T1018","description":"Scattered Spider can enumerate remote systems, such as VMware vCenter infrastructure.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1021.001","description":"Scattered Spider has used RDP to enable lateral movement.","sources":[{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}]},{"technique_id":"T1021.004","description":"Scattered Spider has used SSH to move laterally in victim environments and to access the vSphere vCenter Server GUI.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}]},{"technique_id":"T1021.007","description":"Scattered Spider has also leveraged pre-existing AWS EC2 instances for lateral movement and data collection purposes.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1041","description":"Scattered Spider has exfiltrated data from compromised VMware vCenter servers through an established C2 channel using the Teleport remote access tool.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"technique_id":"T1059.001","description":"Scattered Spider has used the PowerShell cmdlet Get-ADUser.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"}]},{"technique_id":"T1059.004","description":"Scattered Spider has used the command shell to upload and install the Teleport remote access tool to a compromised vCenter Server Appliance.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"technique_id":"T1068","description":"Scattered Spider has deployed a malicious kernel driver through exploitation of CVE-2015-2291 in the Intel Ethernet diagnostics driver for Windows (iqvw64.sys).","sources":[{"source":"CrowdStrike Scattered Spider BYOVD January 2023","url":"https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"}]},{"technique_id":"T1069","description":"Scattered Spider has enumerated the vSphere Admins and ESX Admins groups in targeted environments.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"technique_id":"T1069.002","description":"Scattered Spider has enumerated Active Directory security groups including through the use of ADExplorer, ADRecon.ps1, and Get-ADUser.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"technique_id":"T1070.008","description":"Scattered Spider has manually deleted emails notifying users of suspicious account activity.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"}]},{"technique_id":"T1074","description":"Scattered Spider stages data in a centralized database prior to exfiltration.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1078","description":"Scattered Spider has used compromised credentials for initial access.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}]},{"technique_id":"T1078.004","description":"Scattered Spider has used compromised Microsoft Entra ID accounts to pivot in victim environments.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"}]},{"technique_id":"T1082","description":"Scattered Spider has executed scripts to identify the underlying operating system to ensure it uses the correct installation package for malicious payloads.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"technique_id":"T1083","description":"Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code, user provisioning, MFA device registration, network diagrams, and shared credentials in documents or spreadsheets.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"},{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1087","description":"Scattered Spider has identified vSphere administrator accounts.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"technique_id":"T1087.002","description":"Scattered Spider has enumerated legitimate domain accounts which are used in the targeted environment.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1090","description":"Scattered Spider has used proxy networks to hamper detection and has installed legitimate proxy tools on VMware vCenter and adversary-controlled VMs.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1098","description":"Scattered Spider has added accounts to the ESX Admins group to grant them full admin rights in vSphere.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"technique_id":"T1098.003","description":"Scattered Spider has assigned user access admin roles in order to gain Tenant Root Group management permissions in Azure.","sources":[{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1105","description":"Scattered Spider has downloaded the Teleport remote access tool to compromised VMware vCenter Servers.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"technique_id":"T1114","description":"Scattered Spider searched the victim’s Microsoft Exchange for emails about the intrusion and incident response.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1114.003","description":"Scattered Spider has redirected emails notifying users of suspicious account activity.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"}]},{"technique_id":"T1133","description":"Scattered Spider has leveraged legitimate remote management tools to maintain persistent access.","sources":[{"source":"CrowdStrike Scattered Spider BYOVD January 2023","url":"https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"}]},{"technique_id":"T1136","description":"Scattered Spider creates new user identities within the compromised organization.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1204","description":"Scattered Spider has impersonated organization IT and helpdesk staff to instruct victims to execute commercial remote access tools to gain initial access.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1213.003","description":"Scattered Spider enumerates data stored within victim code repositories, such as internal GitHub repositories.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1213.005","description":"Scattered Spider threat actors search the victim’s Slack and Microsoft Teams for conversations about the intrusion and incident response.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1217","description":"Scattered Spider retrieves browser histories via infostealer malware such as Raccoon Stealer.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1219.002","description":"In addition to directing victims to run remote software, Scattered Spider members themselves also deploy RMM software including TeamViewer, AnyDesk, LogMeIn, ngrok, and ConnectWise to establish persistence on the compromised network.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"Check Point Scattered Spider JUL 2025","url":"https://blog.checkpoint.com/research/exposing-scattered-spider-new-indicators-highlight-growing-threat-to-enterprises-and-aviation/"},{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"},{"source":"Trellix Scattered Spider MO August 2023","url":"https://www.trellix.com/blogs/research/scattered-spider-the-modus-operandi/"}]},{"technique_id":"T1484.002","description":"Scattered Spider adds a federated identity provider to the victim’s SSO tenant and activates automatic account linking.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1486","description":"Scattered Spider has used BlackCat and DragonForce ransomware to encrypt files including on VMWare ESXi servers.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"Check Point Scattered Spider JUL 2025","url":"https://blog.checkpoint.com/research/exposing-scattered-spider-new-indicators-highlight-growing-threat-to-enterprises-and-aviation/"},{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1490","description":"Scattered Spider has stopped the Volume Shadow Copy service on compromised hosts.","sources":[{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}]},{"technique_id":"T1530","description":"Scattered Spider enumerates data stored in cloud resources for collection and exfiltration purposes.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1538","description":"Scattered Spider abused AWS Systems Manager Inventory to identify targets on the compromised network prior to lateral movement.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1539","description":"Scattered Spider retrieves browser cookies via Raccoon Stealer.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1543.002","description":"Scattered Spider has run SYSTEMD_UNIT_PATH=\"/lib/systemd/ system/teleport.service to establish persistence for the Teleport remote access tool.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"technique_id":"T1552.001","description":"Scattered Spider Spider searches for credential storage documentation on a compromised host.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}]},{"technique_id":"T1552.004","description":"Scattered Spider enumerate and exfiltrate code-signing certificates from a compromised host.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1553.002","description":"Scattered Spider has used self-signed and stolen certificates originally issued to NVIDIA and Global Software LLC.","sources":[{"source":"CrowdStrike Scattered Spider BYOVD January 2023","url":"https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"}]},{"technique_id":"T1555.005","description":"Scattered Spider has searched for credentials in password vaults and Privileged Access Management (PAM) solutions including HashiCorp Vault.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}]},{"technique_id":"T1556.006","description":"After compromising user accounts, Scattered Spider registers their own MFA tokens.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1556.009","description":"Scattered Spider has added additional trusted locations to Azure AD conditional access policies.","sources":[{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1564.008","description":"Scattered Spider creates inbound rules on the compromised email accounts of security personnel to automatically delete emails from vendor security products.","sources":[{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1567.002","description":"Scattered Spider has exfiltrated victim data to the MEGA file sharing site, SnowFlake, and AWS S3 buckets.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1572","description":"Scattered Spider has installed protocol-tunneling tools on VMware vCenter and adversary-controlled VMs, including Teleport.sh, Chisel (configured to communicate with trycloudflare[.]com subdomains), MobaXterm, ngrok, Pinggy, and Teleport.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1578.002","description":"Scattered Spider has created Amazon EC2 instances within the victim's environment.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1580","description":"Scattered Spider enumerates cloud environments including Amazon Web Services (AWS) S3 buckets to identify server and backup management infrastructure, resource access, databases and storage containers .","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"},{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1583.001","description":"Scattered Spider has registered domains to spoof legitimate corporate login portals.","sources":[{"source":"Check Point Scattered Spider JUL 2025","url":"https://blog.checkpoint.com/research/exposing-scattered-spider-new-indicators-highlight-growing-threat-to-enterprises-and-aviation/"}]},{"technique_id":"T1585.001","description":"Scattered Spider has created matching fake social media profiles to support new accounts created in victim environments.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"}]},{"technique_id":"T1588.001","description":"Scattered Spider has obtained malware to use at multiple stages of operations including information stealers, remote access tools, and ransomware.","sources":[{"source":"Check Point Scattered Spider JUL 2025","url":"https://blog.checkpoint.com/research/exposing-scattered-spider-new-indicators-highlight-growing-threat-to-enterprises-and-aviation/"},{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}]},{"technique_id":"T1588.002","description":"Scattered Spider has obtained tools for use throughout the attack lifecycle to include remote access software, protocol tunneling and proxy tools, exploitation frameworks, and reconnaissance tools.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"Check Point Scattered Spider JUL 2025","url":"https://blog.checkpoint.com/research/exposing-scattered-spider-new-indicators-highlight-growing-threat-to-enterprises-and-aviation/"},{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}]},{"technique_id":"T1589","description":"Scattered Spider has used information from previous data breaches to identify employee names to be used in social engineering.","sources":[{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"technique_id":"T1598","description":"Scattered Spider has used a combination of credential phishing and social engineering to capture one-time-password (OTP) codes.","sources":[{"source":"CrowdStrike Scattered Spider BYOVD January 2023","url":"https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"}]},{"technique_id":"T1598.003","description":"Scattered Spider has used domains mirroring corporate login portals to socially engineer victims into providing credentials.","sources":[{"source":"Check Point Scattered Spider JUL 2025","url":"https://blog.checkpoint.com/research/exposing-scattered-spider-new-indicators-highlight-growing-threat-to-enterprises-and-aviation/"}]},{"technique_id":"T1598.004","description":"Scattered Spider has used help desk voice-based phishing and also called employees at target organizations and compelled them to navigate to fake login portals using adversary-in-the-middle toolkits.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"Mandiant VMware vSphere JUL 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"},{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1621","description":"Scattered Spider has used multifactor authentication (MFA) fatigue by sending repeated MFA authentication requests to targets.","sources":[{"source":"Check Point Scattered Spider JUL 2025","url":"https://blog.checkpoint.com/research/exposing-scattered-spider-new-indicators-highlight-growing-threat-to-enterprises-and-aviation/"},{"source":"CrowdStrike Scattered Spider BYOVD January 2023","url":"https://www.crowdstrike.com/blog/scattered-spider-attempts-to-avoid-detection-with-bring-your-own-vulnerable-driver-tactic/"}]},{"technique_id":"T1657","description":"Scattered Spider has deployed ransomware on compromised hosts and threatened to leak stolen data for financial gain.","sources":[{"source":"CrowdStrike Scattered Spider JUL 2025","url":"https://www.crowdstrike.com/en-us/blog/crowdstrike-services-observes-scattered-spider-escalate-attacks/"},{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source":"Trellix Scattered Spider MO August 2023","url":"https://www.trellix.com/blogs/research/scattered-spider-the-modus-operandi/"}]},{"technique_id":"T1684.001","description":"Scattered Spider utilized social engineering to compel IT help desk personnel to reset passwords and MFA tokens. Scattered Spider has also used Microsoft Teams to pose as internal IT support or help desk personnel.","sources":[{"source":"CISA Scattered Spider Advisory November 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a"},{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"},{"source":"MSTIC Octo Tempest Operations October 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/10/25/octo-tempest-crosses-boundaries-to-facilitate-extortion-encryption-and-destruction/"}]},{"technique_id":"T1685","description":"Scattered Spider has uninstalled and disabled security tools.","sources":[{"source":"Mandiant UNC3944 May 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/unc3944-proactive-hardening-recommendations"}]}]},{"id":"G1041","name":"Sea Turtle","procedures":[{"technique_id":"T1027.004","description":"Sea Turtle downloaded source code files from remote addresses then compiled them locally via GCC in victim environments.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1059.004","description":"Sea Turtle used shell scripts for post-exploitation execution in victim environments.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"},{"source":"PWC Sea Turtle 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html"}]},{"technique_id":"T1071.001","description":"Sea Turtle connected over TCP using HTTP to establish command and control channels.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1074.002","description":"Sea Turtle staged collected email archives in the public web directory of a website that was accessible from the internet.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1078","description":"Sea Turtle used compromised credentials to maintain long-term access to victim environments.","sources":[{"source":"Talos Sea Turtle 2019","url":"https://blog.talosintelligence.com/seaturtle/"}]},{"technique_id":"T1078.003","description":"Sea Turtle compromised cPanel accounts in victim environments.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1114.001","description":"Sea Turtle collected email archives from victim environments.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1133","description":"Sea Turtle has used external-facing SSH to achieve initial access to the IT environments of victim organizations.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1190","description":"Sea Turtle gained access to victim environments by exploiting multiple known vulnerabilities over several campaigns.","sources":[{"source":"Talos Sea Turtle 2019","url":"https://blog.talosintelligence.com/seaturtle/"},{"source":"PWC Sea Turtle 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html"}]},{"technique_id":"T1199","description":"Sea Turtle targeted third-party entities in trusted relationships with primary targets to ultimately achieve access at primary targets. Entities targeted included DNS registrars, telecommunication companies, and internet service providers.","sources":[{"source":"Talos Sea Turtle 2019","url":"https://blog.talosintelligence.com/seaturtle/"}]},{"technique_id":"T1203","description":"Sea Turtle has used exploits for vulnerabilities such as CVE-2021-44228, CVE-2021-21974, and CVE-2022-0847 to achieve client code execution.","sources":[{"source":"PWC Sea Turtle 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html"}]},{"technique_id":"T1213.006","description":"Sea Turtle used the tool Adminer to remotely logon to the MySQL service of victim machines.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1505.003","description":"Sea Turtle deployed the SnappyTCP web shell during intrusion operations.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"},{"source":"PWC Sea Turtle 2023","url":"https://www.pwc.com/gx/en/issues/cybersecurity/cyber-threat-intelligence/tortoise-and-malwahare.html"}]},{"technique_id":"T1557","description":"Sea Turtle modified DNS records at service providers to redirect traffic from legitimate resources to Sea Turtle-controlled servers to enable adversary-in-the-middle attacks for credential capture.","sources":[{"source":"Talos Sea Turtle 2019","url":"https://blog.talosintelligence.com/seaturtle/"},{"source":"Talos Sea Turtle 2019_2","url":"https://blog.talosintelligence.com/sea-turtle-keeps-on-swimming/"}]},{"technique_id":"T1560.001","description":"Sea Turtle used the tar utility to create a local archive of email data on a victim system.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1564.011","description":"Sea Turtle executed SnappyTCP using the tool NoHup, which keeps the malware running on a system after exiting the shell or terminal.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1566","description":"Sea Turtle used spear phishing to gain initial access to victims.","sources":[{"source":"Talos Sea Turtle 2019","url":"https://blog.talosintelligence.com/seaturtle/"}]},{"technique_id":"T1583","description":"Sea Turtle accessed victim networks from VPN service provider networks.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1583.001","description":"Sea Turtle registered domains for authoritative name servers used in DNS hijacking activity and for command and control servers.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"},{"source":"Talos Sea Turtle 2019_2","url":"https://blog.talosintelligence.com/sea-turtle-keeps-on-swimming/"}]},{"technique_id":"T1583.002","description":"Sea Turtle built adversary-in-the-middle DNS servers to impersonate legitimate services that were later used to capture credentials.","sources":[{"source":"Talos Sea Turtle 2019","url":"https://blog.talosintelligence.com/seaturtle/"},{"source":"Talos Sea Turtle 2019_2","url":"https://blog.talosintelligence.com/sea-turtle-keeps-on-swimming/"}]},{"technique_id":"T1583.003","description":"Sea Turtle created adversary-in-the-middle servers to impersonate legitimate services and enable credential capture.","sources":[{"source":"Talos Sea Turtle 2019","url":"https://blog.talosintelligence.com/seaturtle/"}]},{"technique_id":"T1584.002","description":"Sea Turtle modified Name Server (NS) items to refer to Sea Turtle-controlled DNS servers to provide responses for all DNS lookups.","sources":[{"source":"Talos Sea Turtle 2019","url":"https://blog.talosintelligence.com/seaturtle/"},{"source":"Talos Sea Turtle 2019_2","url":"https://blog.talosintelligence.com/sea-turtle-keeps-on-swimming/"}]},{"technique_id":"T1588.002","description":"Sea Turtle has used tools such as Adminer during intrusions.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1588.004","description":"Sea Turtle created new certificates using a technique called the actors performed \"certificate impersonation,\" a technique in which Sea Turtle obtained a certificate authority-signed X.509 certificate from another provider for the same domain imitating the one already used by the targeted organization.","sources":[{"source":"Talos Sea Turtle 2019","url":"https://blog.talosintelligence.com/seaturtle/"},{"source":"Talos Sea Turtle 2019_2","url":"https://blog.talosintelligence.com/sea-turtle-keeps-on-swimming/"}]},{"technique_id":"T1608.003","description":"Sea Turtle captured legitimate SSL certificates from victim organizations and installed these on Sea Turtle-controlled infrastructure to enable subsequent adversary-in-the-middle operations.","sources":[{"source":"Talos Sea Turtle 2019","url":"https://blog.talosintelligence.com/seaturtle/"}]},{"technique_id":"T1685.006","description":"Sea Turtle has overwritten Linux system logs and unsets the Bash history file (effectively removing logging) during intrusions.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]},{"technique_id":"T1690","description":"Sea Turtle unset the Bash and MySQL history files on victim systems.","sources":[{"source":"Hunt Sea Turtle 2024","url":"https://www.huntandhackett.com/blog/turkish-espionage-campaigns"}]}]},{"id":"G1057","name":"ShinyHunters","procedures":[{"technique_id":"T1016","description":"ShinyHunters has collected machine names and IP addresses by parsing the process scheduler configuration file psappsrv.cfg.","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1018","description":"ShinyHunters has enumerated the internal subnet using cat /etc/hosts | grep -E \"[redacted_victim_string]\".","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1036.005","description":"ShinyHunters has disguised MeshCentral agent binaries as Microsoft Azure services, e.g. meshagent32-azure-ops.exe, meshagent64-azure-ops.exe, and meshagent64-v2.exe.","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1059.007","description":"ShinyHunters has used the MeshCentral command-line interface utility meshctrl.js and npm to interact with compromised systems. Specifically for npm, ShinyHunters has checked for the authenticode tool using the command npm list global authenticode. Additionally, ShinyHunters has used the MeshCentral command to execute the propagation script: node meshctrl.js RunCommand --loginuser admin --loginpass '[password]' --id '[agent_id]' --run 'bash /tmp/[victim_abbreviation]_fanout.sh' .","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1059.009","description":"ShinyHunters has used the AWS Command Line Interface (CLI) for operations to include a variety of API calls, such as ListBuckets, CreateBucket and DeleteBucket.","sources":[{"source":"Unit42KelleyVaya_BlingLibra_Aug2024","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"}]},{"technique_id":"T1069.003","description":"ShinyHunters has executed API calls to enumerate permissions for compromised AWS accounts.","sources":[{"source":"Unit42KelleyVaya_BlingLibra_Aug2024","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"}]},{"technique_id":"T1072","description":"ShinyHunters has abused software deployment tools for lateral movement.","sources":[{"source":"SOCRadar_ShinyHunters_Mar2024","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"technique_id":"T1078","description":"ShinyHunters has used valid high-privileged SSO users as leverage during negotiations.","sources":[{"source":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"}]},{"technique_id":"T1078.002","description":"ShinyHunters has used valid domain accounts to gain initial access or to escalate privileges within environments.","sources":[{"source":"SOCRadar_ShinyHunters_Mar2024","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"technique_id":"T1078.004","description":"ShinyHunters has used valid cloud accounts to gain initial access or to escalate privileges within cloud environments. Additionally, ShinyHunters has also used valid credentials from public repositories to include access keys to gain access to the victim organization’s AWS environment.","sources":[{"source":"Intel471_SH_Aug2021","url":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"},{"source":"Unit42KelleyVaya_BlingLibra_Aug2024","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"},{"source":"SOCRadar_ShinyHunters_Mar2024","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"technique_id":"T1082","description":"ShinyHunters has used the MeshCentral command-line utility meshctrl.js to collect hostnames and IDs of compromised systems.","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1083","description":"ShinyHunters has checked mount points for Oracle PeopleSoft configurations and has checked the process scheduler configuration file psappsrv.cfg. Additionally, ShinyHunters has read WebLogic server XML configurations files (config.xml).","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1090.003","description":"ShinyHunters has used Tor to host their DLS.","sources":[{"source":"FBI_SHLMS_May2026","url":"https://www.ic3.gov/PSA/2026/PSA260515"}]},{"technique_id":"T1105","description":"ShinyHunters has deployed custom scripts to targeted systems from customized MeshAgents in their staging environment.","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1110","description":"ShinyHunters has performed brute force attacks against edge devices, such as VPNs or firewall solutions.","sources":[{"source":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"}]},{"technique_id":"T1190","description":"ShinyHunters has exploited CVE-2026-35273 against Oracle PeopleSoft application infrastructure. ShinyHunters has exploited known vulnerabilities in internet-facing servers.","sources":[{"source":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"},{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1195.001","description":"ShinyHunters has compromised CI/CD pipelines by gaining access to high privilege engineering accounts on Git version control, BrowserStack, JFrog and other cloud project management platforms.","sources":[{"source":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"}]},{"technique_id":"T1203","description":"ShinyHunters has exploited vulnerabilities in the target company’s GitHub repository source code to enable more complex follow-on third-party or supply chain attacks.","sources":[{"source":"Intel471_SH_Aug2021","url":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"}]},{"technique_id":"T1210","description":"ShinyHunters has exploited vulnerabilities in remote services for lateral movement.","sources":[{"source":"SOCRadar_ShinyHunters_Mar2024","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"technique_id":"T1213.003","description":"ShinyHunters has gathered information from and has searched for vulnerabilities in the target company’s GitHub repository source code.","sources":[{"source":"Intel471_SH_Aug2021","url":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"}]},{"technique_id":"T1213.006","description":"ShinyHunters has collected Salesforce datasets from victims in the airline and retail sectors.","sources":[{"source":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"}]},{"technique_id":"T1219","description":"ShinyHunters has used MeshCentral and ConnectWise to gain initial access, to run administrative command queries and to deploy the custom lateral movement and defacement script [victim_abbreviation]_fanout.sh.","sources":[{"source":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"},{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1485","description":"ShinyHunters has executed the DeleteBucket API call to delete buckets.","sources":[{"source":"Unit42KelleyVaya_BlingLibra_Aug2024","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"}]},{"technique_id":"T1491.001","description":"ShinyHunters has left ransom notes titled README-IF-YOU-SEE-THIS-YOUVE-BEEN-HACKED.TXT.","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1528","description":"ShinyHunters has stolen valid OAuth credentials from DevOps personnel or a company GitHub repository. Additionally, ShinyHunters has stolen application access tokens to access cloud services and to bypass authentication mechanisms.","sources":[{"source":"Intel471_SH_Aug2021","url":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"},{"source":"SOCRadar_ShinyHunters_Mar2024","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"technique_id":"T1530","description":"ShinyHunters has collected data from insecure cloud buckets.","sources":[{"source":"SOCRadar_ShinyHunters_Mar2024","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"technique_id":"T1550.001","description":"ShinyHunters has used stolen OAuth keys to access cloud infrastructure and to bypass two-factor authentication.","sources":[{"source":"Intel471_SH_Aug2021","url":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"}]},{"technique_id":"T1552.001","description":"ShinyHunters has gathered PII from database infrastructure.","sources":[{"source":"Intel471_SH_Aug2021","url":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"}]},{"technique_id":"T1560.002","description":"ShinyHunters has used the following command to compress collected data: pv -s \"$(du -sb exfil | awk '{print $1}')\" | zstd -3 -T0 -o exfil.tar.zst .","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1567","description":"ShinyHunters has used compromised Salesforce CRM (Customer Relationship Management) dashboards to exfiltrate bulk data. Additionally, ShinyHunters has used LimeWire, a file-sharing service, to showcase samples of stolen data.","sources":[{"source":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"}]},{"technique_id":"T1573.002","description":"ShinyHunters has established a connection between the staging host and the C2 using SSH.","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1580","description":"ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to collect information on S3 bucket configurations.","sources":[{"source":"Unit42KelleyVaya_BlingLibra_Aug2024","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"},{"source":"SOCRadar_ShinyHunters_Mar2024","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"technique_id":"T1583.001","description":"ShinyHunters has established clearnet and Tor data leak sites (DLS) including one named “SHINYHUNTERS” for the exfiltration and posting of stolen data. Additionally, ShinyHunters has registered domains that mimic legitimate Microsoft Azure NetApp Files endpoints, such as azurenetfiles[.]net, and legitimate Okta SSO login pages, such as trial-6857053.okta[.]com.","sources":[{"source":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"},{"source":"FBI_SHLMS_May2026","url":"https://www.ic3.gov/PSA/2026/PSA260515"},{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"},{"source":"Mandiant_SHDataTheft_Jan2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft"}]},{"technique_id":"T1583.004","description":"ShinyHunters has used five IP addresses to host Python SimpleHTTP servers on port 8888, which exposed staging materials, customized agents, and .bash_history files.","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1585.002","description":"ShinyHunters has established multiple email accounts, such as shinycorp@tutonota[.]com, for use in extortion activities.","sources":[{"source":"Google Salesforce JUN 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion"},{"source":"Unit42KelleyVaya_BlingLibra_Aug2024","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"}]},{"technique_id":"T1587.004","description":"ShinyHunters has exploited zero-day vulnerability CVE-2026-35273 against Oracle PeopleSoft application infrastructure.","sources":[{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1588.002","description":"ShinyHunters has obtained MeshCentral to deploy agents masquerading as legitimate cloud endpoints. ShinyHunters has obtained WinSCP to gather information on S3 bucket configurations. ShinyHunters has obtained ConnectWise and other RMM tools to gain initial access.","sources":[{"source":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"},{"source":"Unit42KelleyVaya_BlingLibra_Aug2024","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"},{"source":"Google_SHOracle_Jun2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/shinyhunters-targets-education-sector-oracle-exploit"}]},{"technique_id":"T1588.007","description":"ShinyHunters has used Bland AI to create conversational pathways tailored to specific scenarios during voice phishing attacks.","sources":[{"source":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"}]},{"technique_id":"T1589.001","description":"ShinyHunters has collected credentials containing PII, ultimately selling the information on their DLS.","sources":[{"source":"Intel471_SH_Aug2021","url":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"},{"source":"Unit42KelleyVaya_BlingLibra_Aug2024","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"}]},{"technique_id":"T1593.003","description":"ShinyHunters has searched through target companies’ GitHub repositories for login credentials or API keys.","sources":[{"source":"SOCRadar_ShinyHunters_Mar2024","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"technique_id":"T1595.002","description":"ShinyHunters has searched through victim companies’ GitHub repositories for vulnerabilities.","sources":[{"source":"SOCRadar_ShinyHunters_Mar2024","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"technique_id":"T1598","description":"ShinyHunters has sent phishing emails to Microsoft Office 365 corporate users in order to steal credentials.","sources":[{"source":"Intel471_SH_Aug2021","url":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"}]},{"technique_id":"T1598.003","description":"ShinyHunters has used spearphishing emails with malicious links to gain initial access and credentials.","sources":[{"source":"SOCRadar_ShinyHunters_Mar2024","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"technique_id":"T1619","description":"ShinyHunters has used Amazon Simple Storage Service (S3) Browser and WinSCP to access S3 objects.","sources":[{"source":"Unit42KelleyVaya_BlingLibra_Aug2024","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"}]},{"technique_id":"T1657","description":"ShinyHunters has called or sent text messages or emails to employees of victim organizations to demand payment in Bitcoin within 72 hours. Email addresses used in extortion activities include shinycorp@tuta[.]com, shinygroup@tuta[.]com, shinycorp@tutanota[.]com, and shinygroup@onionmail[.]com.","sources":[{"source":"ElecticIQ Buyukkaya_ShinyHunters_Sept2025","url":"https://blog.eclecticiq.com/shinyhunters-calling-financially-motivated-data-extortion-group-targeting-enterprise-cloud-applications"},{"source":"FBI_SHLMS_May2026","url":"https://www.ic3.gov/PSA/2026/PSA260515"},{"source":"Google Salesforce JUN 2025","url":"https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion"},{"source":"Intel471_SH_Aug2021","url":"https://www.intel471.com/blog/shinyhunters-data-breach-mitre-attack"},{"source":"Unit42KelleyVaya_BlingLibra_Aug2024","url":"https://unit42.paloaltonetworks.com/shinyhunters-ransomware-extortion/"},{"source":"Mandiant_SHDataTheft_Jan2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/expansion-shinyhunters-saas-data-theft"},{"source":"SOCRadar_ShinyHunters_Mar2024","url":"https://socradar.io/dark-web-profile-shinyhunters/"}]},{"technique_id":"T1684","description":"ShinyHunters has used social engineering to demand payment from victims.","sources":[{"source":"FBI_SHLMS_May2026","url":"https://www.ic3.gov/PSA/2026/PSA260515"}]}]},{"id":"G1008","name":"SideCopy","procedures":[{"technique_id":"T1016","description":"SideCopy has identified the IP address of a compromised host.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1036.005","description":"SideCopy has used a legitimate DLL file name, Duser.dll to disguise a malicious remote access tool.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1059.005","description":"SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling mshta.exe.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1082","description":"SideCopy has identified the OS version of a compromised host.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1105","description":"SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1106","description":"SideCopy has executed malware by calling the API function CreateProcessW.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1204.002","description":"SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1218.005","description":"SideCopy has utilized mshta.exe to execute a malicious hta file.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1518","description":"SideCopy has collected browser information from a compromised host.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1518.001","description":"SideCopy uses a loader DLL file to collect AV product names from an infected host.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1566.001","description":"SideCopy has sent spearphishing emails with malicious hta file attachments.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1574.001","description":"SideCopy has used a malicious loader DLL file to execute the credwiz.exe process and side-load the malicious payload Duser.dll.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1584.001","description":"SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1598.002","description":"SideCopy has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1608.001","description":"SideCopy has used compromised domains to host its malicious payloads.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]},{"technique_id":"T1614","description":"SideCopy has identified the country location of a compromised host.","sources":[{"source":"MalwareBytes SideCopy Dec 2021","url":"https://www.malwarebytes.com/blog/news/2021/12/sidecopy-apt-connecting-lures-to-victims-payloads-to-infrastructure"}]}]},{"id":"G0121","name":"Sidewinder","procedures":[{"technique_id":"T1016","description":"Sidewinder has used malware to collect information on network interfaces, including the MAC address.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1020","description":"Sidewinder has configured tools to automatically send collected files to attacker controlled servers.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1027.010","description":"Sidewinder has used base64 encoding for scripts.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"}]},{"technique_id":"T1027.013","description":"Sidewinder has used base64 encoding and ECDH-P256 encryption for payloads.","sources":[{"source":"Cyble Sidewinder September 2020","url":"https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"},{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"}]},{"technique_id":"T1033","description":"Sidewinder has used tools to identify the user of a compromised host.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1036.005","description":"Sidewinder has named malicious files rekeywiz.exe to match the name of a legitimate Windows executable.","sources":[{"source":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"}]},{"technique_id":"T1057","description":"Sidewinder has used tools to identify running processes on the victim's machine.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1059.001","description":"Sidewinder has used PowerShell to drop and execute malware loaders.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1059.005","description":"Sidewinder has used VBScript to drop and execute malware loaders.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1059.007","description":"Sidewinder has used JavaScript to drop and execute malware loaders.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"}]},{"technique_id":"T1071.001","description":"Sidewinder has used HTTP in C2 communications.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"},{"source":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"}]},{"technique_id":"T1074.001","description":"Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1082","description":"Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"}]},{"technique_id":"T1083","description":"Sidewinder has used malware to collect information on files and directories.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1105","description":"Sidewinder has used LNK files to download remote files to the victim's network.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Cyble Sidewinder September 2020","url":"https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"}]},{"technique_id":"T1119","description":"Sidewinder has used tools to automatically collect system and network configuration information.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1124","description":"Sidewinder has used tools to obtain the current system time.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1203","description":"Sidewinder has exploited vulnerabilities to gain execution including CVE-2017-11882 and CVE-2020-0674.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Cyble Sidewinder September 2020","url":"https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"}]},{"technique_id":"T1204.001","description":"Sidewinder has lured targets to click on malicious links to gain execution in the target environment.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"},{"source":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"},{"source":"Cyble Sidewinder September 2020","url":"https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"}]},{"technique_id":"T1204.002","description":"Sidewinder has lured targets to click on malicious files to gain execution in the target environment.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"},{"source":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"},{"source":"Cyble Sidewinder September 2020","url":"https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"}]},{"technique_id":"T1218.005","description":"Sidewinder has used mshta.exe to execute malicious payloads.","sources":[{"source":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"},{"source":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"}]},{"technique_id":"T1518","description":"Sidewinder has used tools to enumerate software installed on an infected host.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"}]},{"technique_id":"T1518.001","description":"Sidewinder has used the Windows service winmgmts:\\\\.\\root\\SecurityCenter2 to check installed antivirus products.","sources":[{"source":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"}]},{"technique_id":"T1547.001","description":"Sidewinder has added paths to executables in the Registry to establish persistence.","sources":[{"source":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"},{"source":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"},{"source":"Cyble Sidewinder September 2020","url":"https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"}]},{"technique_id":"T1559.002","description":"Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.","sources":[{"source":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"},{"source":"Rewterz Sidewinder COVID-19 June 2020","url":"https://www.rewterz.com/articles/analysis-on-sidewinder-apt-group-covid-19"}]},{"technique_id":"T1566.001","description":"Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1566.002","description":"Sidewinder has sent e-mails with malicious links often crafted for specific targets.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Cyble Sidewinder September 2020","url":"https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"}]},{"technique_id":"T1574.001","description":"Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]},{"technique_id":"T1598.002","description":"Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"},{"source":"Rewterz Sidewinder APT April 2020","url":"https://www.rewterz.com/threats/sidewinder-apt-group-campaign-analysis"},{"source":"Cyble Sidewinder September 2020","url":"https://cybleinc.com/2020/09/26/sidewinder-apt-targets-with-futuristic-tactics-and-techniques/"}]},{"technique_id":"T1598.003","description":"Sidewinder has sent e-mails with malicious links to credential harvesting websites.","sources":[{"source":"ATT Sidewinder January 2021","url":"https://cdn-cybersecurity.att.com/docs/global-perspective-of-the-sidewinder-apt.pdf"}]}]},{"id":"G0091","name":"Silence","procedures":[{"technique_id":"T1003.001","description":"Silence has used the Farse6.1 utility (based on Mimikatz) to extract credentials from lsass.exe.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1018","description":"Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1021.001","description":"Silence has used RDP for lateral movement.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1027.010","description":"Silence has used environment variable string substitution for obfuscation.","sources":[{"source":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}]},{"technique_id":"T1036.005","description":"Silence has named its backdoor \"WINWORD.exe\".","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1053.005","description":"Silence has used scheduled tasks to stage its operation.","sources":[{"source":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}]},{"technique_id":"T1055","description":"Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1059.001","description":"Silence has used PowerShell to download and execute payloads.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."},{"source":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}]},{"technique_id":"T1059.003","description":"Silence has used Windows command-line to run commands.","sources":[{"source":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."},{"source":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}]},{"technique_id":"T1059.005","description":"Silence has used VBS scripts.","sources":[{"source":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}]},{"technique_id":"T1059.007","description":"Silence has used JS scripts.","sources":[{"source":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}]},{"technique_id":"T1070.004","description":"Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."},{"source":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}]},{"technique_id":"T1072","description":"Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1078","description":"Silence has used compromised credentials to log on to other systems and escalate privileges.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1090.002","description":"Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\\Socks5.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1105","description":"Silence has downloaded additional modules and malware to victim’s machines.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1106","description":"Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.","sources":[{"source":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1112","description":"Silence can create, delete, or modify a specified Registry key or value.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1113","description":"Silence can capture victim screen activity.","sources":[{"source":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1125","description":"Silence has been observed making videos of victims to observe bank employees day to day activities.","sources":[{"source":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1204.002","description":"Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.","sources":[{"source":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."},{"source":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}]},{"technique_id":"T1218.001","description":"Silence has weaponized CHM files in their phishing campaigns.","sources":[{"source":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."},{"source":"Group IB Silence Aug 2019","url":"https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf"},{"source":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}]},{"technique_id":"T1547.001","description":"Silence has used HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, HKLM\\Software\\Microsoft\\Windows\\CurrentVersion\\Run, and the Startup folder to establish persistence.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1553.002","description":"Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).","sources":[{"source":"Group IB Silence Aug 2019","url":"https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf"}]},{"technique_id":"T1566.001","description":"Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments.","sources":[{"source":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."},{"source":"Cyber Forensicator Silence Jan 2019","url":"https://web.archive.org/web/20220119133748/https://cyberforensicator.com/2019/01/20/silence-dissecting-malicious-chm-files-and-performing-forensic-analysis/"}]},{"technique_id":"T1569.002","description":"Silence has used Winexe to install a service on the remote system.","sources":[{"source":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"},{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1571","description":"Silence has used port 444 when sending data about the system from the client to the server.","sources":[{"source":"Group IB Silence Sept 2018","url":"https://go.group-ib.com/report-silence-en?_gl=1*d1bh3a*_ga*MTIwMzM5Mzc5MS4xNjk4OTI5NzY4*_ga_QMES53K3Y2*MTcwNDcyMjU2OS40LjEuMTcwNDcyMzU1Mi41My4wLjA."}]},{"technique_id":"T1588.002","description":"Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.","sources":[{"source":"Group IB Silence Aug 2019","url":"https://www.group-ib.com/resources/threat-research/silence_2.0.going_global.pdf"},{"source":"SecureList Silence Nov 2017","url":"https://securelist.com/the-silence/83009/"}]}]},{"id":"G0122","name":"Silent Librarian","procedures":[{"technique_id":"T1078","description":"Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.","sources":[{"source":"DOJ Iran Indictments March 2018","url":"https://www.justice.gov/usao-sdny/press-release/file/1045781/download"}]},{"technique_id":"T1110.003","description":"Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.","sources":[{"source":"DOJ Iran Indictments March 2018","url":"https://www.justice.gov/usao-sdny/press-release/file/1045781/download"}]},{"technique_id":"T1114","description":"Silent Librarian has exfiltrated entire mailboxes from compromised accounts.","sources":[{"source":"DOJ Iran Indictments March 2018","url":"https://www.justice.gov/usao-sdny/press-release/file/1045781/download"}]},{"technique_id":"T1114.003","description":"Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.","sources":[{"source":"DOJ Iran Indictments March 2018","url":"https://www.justice.gov/usao-sdny/press-release/file/1045781/download"}]},{"technique_id":"T1583.001","description":"Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.","sources":[{"source":"DOJ Iran Indictments March 2018","url":"https://www.justice.gov/usao-sdny/press-release/file/1045781/download"},{"source":"Phish Labs Silent Librarian","url":"https://info.phishlabs.com/blog/silent-librarian-more-to-the-story-of-the-iranian-mabna-institute-indictment"},{"source":"Secureworks COBALT DICKENS August 2018","url":"https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities"},{"source":"Proofpoint TA407 September 2019","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"},{"source":"Secureworks COBALT DICKENS September 2019","url":"https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again"},{"source":"Malwarebytes Silent Librarian October 2020","url":"https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/"}]},{"technique_id":"T1585.002","description":"Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.","sources":[{"source":"DOJ Iran Indictments March 2018","url":"https://www.justice.gov/usao-sdny/press-release/file/1045781/download"}]},{"technique_id":"T1588.002","description":"Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.","sources":[{"source":"Proofpoint TA407 September 2019","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"},{"source":"Secureworks COBALT DICKENS September 2019","url":"https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again"}]},{"technique_id":"T1588.004","description":"Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.","sources":[{"source":"Phish Labs Silent Librarian","url":"https://info.phishlabs.com/blog/silent-librarian-more-to-the-story-of-the-iranian-mabna-institute-indictment"},{"source":"Secureworks COBALT DICKENS September 2019","url":"https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again"}]},{"technique_id":"T1589.002","description":"Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.","sources":[{"source":"DOJ Iran Indictments March 2018","url":"https://www.justice.gov/usao-sdny/press-release/file/1045781/download"}]},{"technique_id":"T1589.003","description":"Silent Librarian has collected lists of names for individuals from targeted organizations.","sources":[{"source":"DOJ Iran Indictments March 2018","url":"https://www.justice.gov/usao-sdny/press-release/file/1045781/download"}]},{"technique_id":"T1594","description":"Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.","sources":[{"source":"DOJ Iran Indictments March 2018","url":"https://www.justice.gov/usao-sdny/press-release/file/1045781/download"},{"source":"Phish Labs Silent Librarian","url":"https://info.phishlabs.com/blog/silent-librarian-more-to-the-story-of-the-iranian-mabna-institute-indictment"},{"source":"Proofpoint TA407 September 2019","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"}]},{"technique_id":"T1598.003","description":"Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.","sources":[{"source":"DOJ Iran Indictments March 2018","url":"https://www.justice.gov/usao-sdny/press-release/file/1045781/download"},{"source":"Phish Labs Silent Librarian","url":"https://info.phishlabs.com/blog/silent-librarian-more-to-the-story-of-the-iranian-mabna-institute-indictment"},{"source":"Secureworks COBALT DICKENS August 2018","url":"https://www.secureworks.com/blog/back-to-school-cobalt-dickens-targets-universities"},{"source":"Proofpoint TA407 September 2019","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"},{"source":"Secureworks COBALT DICKENS September 2019","url":"https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again"},{"source":"Malwarebytes Silent Librarian October 2020","url":"https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/"}]},{"technique_id":"T1608.005","description":"Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns. Silent Librarian has also made use of a variety of URL shorteners for these staged websites.","sources":[{"source":"Secureworks COBALT DICKENS September 2019","url":"https://www.secureworks.com/blog/cobalt-dickens-goes-back-to-school-again"},{"source":"Malwarebytes Silent Librarian October 2020","url":"https://blog.malwarebytes.com/malwarebytes-news/2020/10/silent-librarian-apt-phishing-attack/"},{"source":"Proofpoint TA407 September 2019","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta407-silent-librarian"}]}]},{"id":"G0083","name":"SilverTerrier","procedures":[{"technique_id":"T1071.001","description":"SilverTerrier uses HTTP for C2 communications.","sources":[{"source":"Unit42 SilverTerrier 2018","url":"https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/unit42-silverterrier-rise-of-nigerian-business-email-compromise"}]},{"technique_id":"T1071.002","description":"SilverTerrier uses FTP for C2 communications.","sources":[{"source":"Unit42 SilverTerrier 2018","url":"https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/unit42-silverterrier-rise-of-nigerian-business-email-compromise"}]},{"technique_id":"T1071.003","description":"SilverTerrier uses SMTP for C2 communications.","sources":[{"source":"Unit42 SilverTerrier 2018","url":"https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/unit42-silverterrier-rise-of-nigerian-business-email-compromise"}]},{"technique_id":"T1657","description":"SilverTerrier targets organizations in high technology, higher education, and manufacturing for business email compromise (BEC) campaigns with the goal of financial theft.","sources":[{"source":"Unit42 SilverTerrier 2016","url":"https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/silverterrier-next-evolution-in-nigerian-cybercrime.pdf"},{"source":"Unit42 SilverTerrier 2018","url":"https://www.paloaltonetworks.com/apps/pan/public/downloadResource?pagePath=/content/pan/en_US/resources/whitepapers/unit42-silverterrier-rise-of-nigerian-business-email-compromise"}]}]},{"id":"G0054","name":"Sowbug","procedures":[{"technique_id":"T1003","description":"Sowbug has used credential dumping tools.","sources":[{"source":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"technique_id":"T1036.005","description":"Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory CSIDL_APPDATA\\microsoft\\security.","sources":[{"source":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"technique_id":"T1039","description":"Sowbug extracted Word documents from a file server on a victim network.","sources":[{"source":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"technique_id":"T1056.001","description":"Sowbug has used keylogging tools.","sources":[{"source":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"technique_id":"T1059.003","description":"Sowbug has used command line during its intrusions.","sources":[{"source":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"technique_id":"T1082","description":"Sowbug obtained OS version and hardware configuration from a victim.","sources":[{"source":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"technique_id":"T1083","description":"Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.","sources":[{"source":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"technique_id":"T1135","description":"Sowbug listed remote shared drives that were accessible from a victim.","sources":[{"source":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]},{"technique_id":"T1560.001","description":"Sowbug extracted documents and bundled them into a RAR archive.","sources":[{"source":"Symantec Sowbug Nov 2017","url":"https://www.symantec.com/connect/blogs/sowbug-cyber-espionage-group-targets-south-american-and-southeast-asian-governments"}]}]},{"id":"G1033","name":"Star Blizzard","procedures":[{"technique_id":"T1059.007","description":"Star Blizzard has used JavaScript to redirect victim traffic from an adversary controlled server to a server hosting the Evilginx phishing framework.","sources":[{"source":"StarBlizzard","url":"https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"}]},{"technique_id":"T1078","description":"Star Blizzard has used stolen credentials to sign into victim email accounts.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"},{"source":"Microsoft Star Blizzard August 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"}]},{"technique_id":"T1114.002","description":"Star Blizzard has remotely accessed victims' email accounts to steal messages and attachments.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"}]},{"technique_id":"T1114.003","description":"Star Blizzard has abused email forwarding rules to monitor the activities of a victim, steal information, and maintain persistent access after compromised credentials are reset.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"},{"source":"Microsoft Star Blizzard August 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"}]},{"technique_id":"T1204.002","description":"Star Blizzard has lured targets into opening malicious .pdf files to deliver malware.","sources":[{"source":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}]},{"technique_id":"T1539","description":"Star Blizzard has used EvilGinx to steal the session cookies of victims directed to phishing domains.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"}]},{"technique_id":"T1550.004","description":"Star Blizzard has bypassed multi-factor authentication on victim email accounts by using session cookies stolen using EvilGinx.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"}]},{"technique_id":"T1566.001","description":"Star Blizzard has sent emails with malicious .pdf files to spread malware.","sources":[{"source":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}]},{"technique_id":"T1583","description":"Star Blizzard has used HubSpot and MailerLite marketing platform services to hide the true sender of phishing emails.","sources":[{"source":"StarBlizzard","url":"https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"}]},{"technique_id":"T1583.001","description":"Star Blizzard has registered domains using randomized words and with names resembling legitimate organizations.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"},{"source":"StarBlizzard","url":"https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"}]},{"technique_id":"T1585.001","description":"Star Blizzard has established fraudulent profiles on professional networking sites to conduct reconnaissance.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"},{"source":"Microsoft Star Blizzard August 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"}]},{"technique_id":"T1585.002","description":"Star Blizzard has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"},{"source":"Microsoft Star Blizzard August 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"},{"source":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}]},{"technique_id":"T1586.002","description":"Star Blizzard has used compromised email accounts to conduct spearphishing against contacts of the original victim.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"}]},{"technique_id":"T1588.002","description":"Star Blizzard has incorporated the open-source EvilGinx framework into their spearphishing activity.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"},{"source":"StarBlizzard","url":"https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"}]},{"technique_id":"T1589","description":"Star Blizzard has identified ways to engage targets by researching potential victims' interests and social or professional contacts.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"}]},{"technique_id":"T1593","description":"Star Blizzard has used open-source research to identify information about victims to use in targeting.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"},{"source":"Microsoft Star Blizzard August 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"}]},{"technique_id":"T1598.002","description":"Star Blizzard has sent emails to establish rapport with targets eventually sending messages with attachments containing links to credential-stealing sites.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"},{"source":"Microsoft Star Blizzard August 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"},{"source":"StarBlizzard","url":"https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"},{"source":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}]},{"technique_id":"T1598.003","description":"Star Blizzard has sent emails to establish rapport with targets eventually sending messages with links to credential-stealing sites.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"},{"source":"Microsoft Star Blizzard August 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"},{"source":"StarBlizzard","url":"https://www.microsoft.com/en-us/security/blog/2023/12/07/star-blizzard-increases-sophistication-and-evasion-in-ongoing-attacks/"},{"source":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}]},{"technique_id":"T1608.001","description":"Star Blizzard has uploaded malicious payloads to cloud storage sites.","sources":[{"source":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}]},{"technique_id":"T1684.001","description":"Star Blizzard has registered impersonation email accounts to spoof experts in a particular field or individuals and organizations affiliated with the intended target.","sources":[{"source":"CISA Star Blizzard Advisory December 2023","url":"https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-341a"},{"source":"Microsoft Star Blizzard August 2022","url":"https://www.microsoft.com/en-us/security/blog/2022/08/15/disrupting-seaborgiums-ongoing-phishing-operations/"},{"source":"Google TAG COLDRIVER January 2024","url":"https://blog.google/threat-analysis-group/google-tag-coldriver-russian-phishing-malware/"}]}]},{"id":"G0038","name":"Stealth Falcon","procedures":[{"technique_id":"T1005","description":"Stealth Falcon malware gathers data from the local victim system.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1012","description":"Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1016","description":"Stealth Falcon malware gathers the Address Resolution Protocol (ARP) table from the victim.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1033","description":"Stealth Falcon malware gathers the registered user and primary owner name via WMI.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1041","description":"After data is collected by Stealth Falcon malware, it is exfiltrated over the existing C2 channel.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1047","description":"Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1053.005","description":"Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1057","description":"Stealth Falcon malware gathers a list of running processes.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1059","description":"Stealth Falcon malware uses WMI to script data collection and command execution on the victim.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1059.001","description":"Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1071.001","description":"Stealth Falcon malware communicates with its C2 server via HTTPS.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1082","description":"Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1555","description":"Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1555.003","description":"Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1555.004","description":"Stealth Falcon malware gathers passwords from the Windows Credential Vault.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]},{"technique_id":"T1573.001","description":"Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.","sources":[{"source":"Citizen Lab Stealth Falcon May 2016","url":"https://citizenlab.org/2016/05/stealth-falcon/"}]}]},{"id":"G1053","name":"Storm-0501","procedures":[{"technique_id":"T1003","description":"Storm-0501 has used the SecretsDump module within Impacket can perform credential dumping to obtain account and password information.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1003.006","description":"Storm-0501 has utilized DCSync to extract credentials from victims.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1021.006","description":"Storm-0501 has utilized the post-exploitation tool known as Evil-WinRM that uses PowerShell over Windows Remote Management (WinRM) for remote code execution.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1021.007","description":"Storm-0501 has used compromised Entra Connect Sync Server to move laterally within the victim environment.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1027.002","description":"Storm-0501 has used Themida to pack Cobalt Strike payloads.","sources":[{"source":"Google Mandiant Storm-0501 Sabbath Ransomware November 2021","url":"https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/"}]},{"technique_id":"T1036.004","description":"Storm-0501 has utilized Rclone masqueraded as svhost.exe and scvhost.exe.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1053.005","description":"Storm-0501 had used a scheduled task named “SysUpdate” that was registered via GPO on devices in the network to distribute the Embargo ransomware.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1057","description":"Storm-0501 has discovered running processes through tasklist.exe.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1059.001","description":"Storm-0501 has leveraged PowerShell to execute commands and scripts.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"},{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1059.009","description":"Storm-0501 has leveraged Cloud CLI to execute commands and exfiltrate data from compromised environments.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1078.004","description":"Storm-0501 has leveraged compromised accounts to access Microsoft Entra Connect, which was used to synchronize on-premises identities and Microsoft Entra identities, allowing users to sign into both environments with the same password. Storm-0501 has also used the victim Global Administrator account that lacked any registered MFA method to access victim cloud environments. Storm-0501 has leveraged Storage Account Access Keys within the victim environment.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"},{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1082","description":"Storm-0501 has leveraged native Windows tools and commands such as systeminfo and open-source tools including OSQuery and ossec-win32 to query details about the endpoint.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1087.002","description":"Storm-0501 has utilized an obfuscated version of the Active Directory reconnaissance tool ADRecon.ps1 (obfs.ps1 or recon.ps1) to discover domain accounts.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1087.004","description":"Storm-0501 has conducted enumeration of users, roles, and resources within victim Azure tenants using the tool Azurehound.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1098.001","description":"Storm-0501 has reset the password of identified administrator accounts that lack MFA and registered their own MFA method.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1098.003","description":"Storm-0501 has elevated their access to Azure resources using Microsoft.Authorization/elevateAccess/action and Microsoft.Authorization/roleAssignments/write operations to gain User Access Administrator and Owner Azure roles over the victims’ Azure subscriptions.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1110","description":"Storm-0501 has leveraged brute force attacks to obtain credentials.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1190","description":"Storm-0501 has exploited N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1218.010","description":"Storm-0501 has launched Cobalt Strike Beacon files using regsvr32.exe.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1218.011","description":"Storm-0501 has launched Cobalt Strike Beacon files with rundll32.exe.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1219.002","description":"Storm-0501 has used legitimate remote monitoring and management (RMM) tools including AnyDesk, NinjaOne, and Level.io.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1482","description":"Storm-0501 has used Windows native utility Nltest nltest.exe for discovery.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1484.001","description":"Storm-0501 distributed Group Policy Objects to tamper with security products.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1484.002","description":"Storm-0501 created a new federated domain within the victim Microsoft Entra tenant using Global Administrator level access to establish a persistent backdoor for later use.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"},{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1485","description":"Storm-0501 has destroyed data and backup files.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1486","description":"Storm-0501 has encrypted files in victim environments using ransomware as a service (RaaS) including Sabbath, Hive, BlackCat, Hunters International, LockBit 3.0 and Embargo ransomware.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1490","description":"Storm-0501 has deleted snapshots, restore points, storage accounts, and backup services to prevent remediation and restoration. Storm-0501 has also impacted Azure resources through the targeting of Microsoft.Compute/snapshots/delete, Microsoft.Compute/restorePointCollections/delete, Microsoft.Storage/storageAccounts/delete, and Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/delete.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1518.001","description":"Storm-0501 has detected endpoint security solutions using sc query sense and sc query windefend.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1526","description":"Storm-0501 has discovered the victim environment’s protections to include Azure policies, resource locks, and Azure Storage immutability policies.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1530","description":"Storm-0501 had modified Azure Storage account resources through the Microsoft.Storage/storageAccounts/write operation to expose non-remotely accessible accounts for data exfiltration.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1537","description":"Storm-0501 has copied data from the victims environment to their own infrastructure leveraging AzCopy CLI.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1552.004","description":"Storm-0501 has leveraged the Azure Owner role to access and steal the Storage Account Access keys using the Microsoft.Storage/storageAccounts/listkeys/action operation.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1555.005","description":"Storm-0501 has stolen credentials contained in the password manager Keepass by utilizing Find-KeePassConfig.ps1.","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1555.006","description":"Storm-0501 has utilized Azure Key Vault to store the encryption key using the operation Microsoft.KeyVault/Vaults/write.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1556.009","description":"Storm-0501 has registered their own MFA method, and leveraged a victim hybrid joined server to circumvent Conditional Access Policies.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1567.002","description":"Storm-0501 has exfiltrated stolen data to the MEGA file sharing site. Storm-0501 has also utilized Rclone to exfiltrate data from victim environments to cloud storage such as MegaSync. Storm-0501 has exfiltrated data to their own infrastructure utilizing AzCopy Command-Line tool (CLI).","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"},{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"},{"source":"Google Mandiant Storm-0501 Sabbath Ransomware November 2021","url":"https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/"}]},{"technique_id":"T1578.003","description":"Storm-0501 has conducted mass deletion of cloud data stores and resources from Azure subscriptions.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1580","description":"Storm-0501 has enumerated compromised cloud environments to identify critical assets, data stores, and back resources.","sources":[{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"}]},{"technique_id":"T1587.003","description":"Storm-0501 has utilized their own self-signed TLS certificate “Microsoft IT TLS CA 5” with their infrastructure.","sources":[{"source":"Google Mandiant Storm-0501 Sabbath Ransomware November 2021","url":"https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/"}]},{"technique_id":"T1588.006","description":"Storm-0501 has obtained capabilities to exploit N-day vulnerabilities associated with public facing services to gain initial access to victim environments to include Zoho ManageEngine (CVE-2022-47966), Citrix NetScaler “Citrix Bleed” (CVE-2023-4966), and Adobe ColdFusion 2016 (CVE-2023-29300 or CVE-2023-38203).","sources":[{"source":"Microsoft Storm-501 Sabbath Ransomware Embargo September 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/09/26/storm-0501-ransomware-attacks-expanding-to-hybrid-cloud-environments/"}]},{"technique_id":"T1614.001","description":"Storm-0501 has identified system language codes on a compromised host to determine if the victim falls under a non-supported language code that is prohibited for targeting, including victims associated with Russia and other Commonwealth of Independent States (CIS) that may draw attention of law enforcement in countries where the ransomware operator or affiliates may reside/operate from.","sources":[{"source":"Avertium Storm-0501 Sabbath Ransomware Arcane January 2022","url":"https://www.avertium.com/resources/threat-reports/in-depth-look-at-sabbath-ransomware-gang"},{"source":"Google Mandiant Storm-0501 Sabbath Ransomware November 2021","url":"https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/"}]},{"technique_id":"T1657","description":"Storm-0501 has engaged in double-extortion ransomware, exfiltrating data and directly contacting victims when the primary organization refuses to pay along with posting data on their data leak sites.","sources":[{"source":"Avertium Storm-0501 Sabbath Ransomware Arcane January 2022","url":"https://www.avertium.com/resources/threat-reports/in-depth-look-at-sabbath-ransomware-gang"},{"source":"Microsoft Storm-0501 Embargo Ransomware August 2025","url":"https://www.microsoft.com/en-us/security/blog/2025/08/27/storm-0501s-evolving-techniques-lead-to-cloud-based-ransomware/"},{"source":"Google Mandiant Storm-0501 Sabbath Ransomware November 2021","url":"https://cloud.google.com/blog/topics/threat-intelligence/sabbath-ransomware-affiliate/"}]}]},{"id":"G1046","name":"Storm-1811","procedures":[{"technique_id":"T1021.002","description":"Storm-1811 has attempted to move laterally in victim environments via SMB using Impacket.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1021.004","description":"Storm-1811 has used OpenSSH to establish an SSH tunnel to victims for persistent access.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}]},{"technique_id":"T1027.013","description":"Storm-1811 XOR encodes a Cobalt Strike installation payload in a DLL file that is decoded with a hardcoded key when called by a legitimate 7zip installation process.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1033","description":"Storm-1811 has used whoami.exe to determine if the active user on a compromised system is an administrator.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1036","description":"Storm-1811 has prompted users to download and execute batch scripts that masquerade as legitimate update files during initial access and social engineering operations.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1036.005","description":"Storm-1811 has disguised Cobalt Strike installers as a malicious DLL masquerading as part of a legitimate 7zip installation package.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1036.010","description":"Storm-1811 has created Microsoft Teams accounts that spoof IT support and helpdesk members for use in application and voice phishing.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}]},{"technique_id":"T1048.002","description":"Storm-1811 has exfiltrated captured user credentials via Secure Copy Protocol (SCP).","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1056","description":"Storm-1811 has used a PowerShell script to capture user credentials after prompting a user to authenticate to run a malicious script masquerading as a legitimate update item.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1059.001","description":"Storm-1811 has used PowerShell for multiple purposes, such as using PowerShell scripts executing in an infinite loop to create an SSH connection to a command and control server.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1059.003","description":"Storm-1811 has used multiple batch scripts during initial access and subsequent actions on victim machines.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"},{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1074.001","description":"Storm-1811 has locally staged captured credentials for subsequent manual exfiltration.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1087.002","description":"Storm-1811 has performed domain account enumeration during intrusions.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}]},{"technique_id":"T1105","description":"Storm-1811 has used scripted cURL commands, BITSAdmin, and other mechanisms to retrieve follow-on batch scripts and tools for execution on victim devices.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"},{"source":"RedCanary June Insights 2024","url":"https://redcanary.com/blog/threat-intelligence/intelligence-insights-june-2024/"},{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1140","description":"Storm-1811 has distributed password-protected archives such as ZIP files during intrusions.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1204.002","description":"Storm-1811 has prompted users to execute downloaded software and payloads as the result of social engineering activity.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"},{"source":"RedCanary Storm-1811 2024","url":"https://redcanary.com/blog/threat-intelligence/storm-1811-black-basta/"},{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1219.002","description":"Storm-1811 has abused multiple types of legitimate remote access software and tools, such as ScreenConnect, NetSupport Manager, and AnyDesk.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"},{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1222.001","description":"Storm-1811 has used cacls.exe via batch script to modify file and directory permissions in victim environments.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1482","description":"Storm-1811 has enumerated domain accounts and access during intrusions.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}]},{"technique_id":"T1486","description":"Storm-1811 is a financially-motivated entity linked to the deployment of Black Basta ransomware in victim environments.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}]},{"technique_id":"T1547.001","description":"Storm-1811 has created Windows Registry Run keys that execute various batch scripts to establish persistence on victim devices.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1566.002","description":"Storm-1811 has distributed malicious links to victims that redirect to EvilProxy-based phishing sites to harvest credentials.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}]},{"technique_id":"T1566.003","description":"Storm-1811 has used Microsoft Teams to send messages and initiate voice calls to victims posing as IT support personnel.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}]},{"technique_id":"T1566.004","description":"Storm-1811 has initiated voice calls with victims posing as IT support to prompt users to download and execute scripts and other tools for initial access.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"},{"source":"RedCanary Storm-1811 2024","url":"https://redcanary.com/blog/threat-intelligence/storm-1811-black-basta/"},{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1570","description":"Storm-1811 has used the Impacket toolset to move and remotely execute payloads to other hosts in victim networks.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1574.001","description":"Storm-1811 has deployed a malicious DLL (7z.DLL) that is sideloaded by a modified, legitimate installer (7zG.exe) when that installer is executed with an additional command line parameter of b at runtime to load a Cobalt Strike beacon payload.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1583.001","description":"Storm-1811 has created domains for use with RMM tools.","sources":[{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1585.003","description":"Storm-1811 has created malicious accounts to enable activity via Microsoft Teams, typically spoofing various IT support and helpdesk themes.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}]},{"technique_id":"T1588.002","description":"Storm-1811 acquired various legitimate and malicious tools, such as RMM software and commodity malware packages, for operations.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"},{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1667","description":"Storm-1811 has deployed large volumes of non-malicious email spam to victims in order to prompt follow-on interactions with the threat actor posing as IT support or helpdesk to resolve the problem.","sources":[{"source":"RedCanary Storm-1811 2024","url":"https://redcanary.com/blog/threat-intelligence/storm-1811-black-basta/"},{"source":"rapid7-email-bombing","url":"https://www.rapid7.com/blog/post/2024/05/10/ongoing-social-engineering-campaign-linked-to-black-basta-ransomware-operators"}]},{"technique_id":"T1684.001","description":"Storm-1811 impersonates help desk and IT support personnel for phishing and social engineering purposes during initial access to victim environments.","sources":[{"source":"Microsoft Storm-1811 2024","url":"https://www.microsoft.com/en-us/security/blog/2024/05/15/threat-actors-misusing-quick-assist-in-social-engineering-attacks-leading-to-ransomware/"}]}]},{"id":"G0041","name":"Strider","procedures":[{"technique_id":"T1090.001","description":"Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.","sources":[{"source":"Kaspersky ProjectSauron Blog","url":"https://securelist.com/faq-the-projectsauron-apt/75533/"}]},{"technique_id":"T1556.002","description":"Strider has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.","sources":[{"source":"Kaspersky ProjectSauron Full Report","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf"}]},{"technique_id":"T1564.005","description":"Strider has used a hidden file system that is stored as a file on disk.","sources":[{"source":"Kaspersky ProjectSauron Full Report","url":"https://securelist.com/files/2016/07/The-ProjectSauron-APT_research_KL.pdf"}]}]},{"id":"G0039","name":"Suckfly","procedures":[{"technique_id":"T1003","description":"Suckfly used a signed credential-dumping tool to obtain victim account credentials.","sources":[]},{"technique_id":"T1046","description":"Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.","sources":[]},{"technique_id":"T1059.003","description":"Several tools used by Suckfly have been command-line driven.","sources":[]},{"technique_id":"T1078","description":"Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.","sources":[]},{"technique_id":"T1553.002","description":"Suckfly has used stolen certificates to sign its malware.","sources":[]}]},{"id":"G1018","name":"TA2541","procedures":[{"technique_id":"T1016.001","description":"TA2541 has run scripts to check internet connectivity from compromised hosts.","sources":[{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1027.002","description":"TA2541 has used a .NET packer to obfuscate malicious files.","sources":[{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1027.013","description":"TA2541 has used compressed and char-encoded scripts in operations.","sources":[{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1027.015","description":"TA2541 has used compressed and char-encoded scripts in operations.","sources":[{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1036.005","description":"TA2541 has used file names to mimic legitimate Windows files or system functionality.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"technique_id":"T1047","description":"TA2541 has used WMI to query targeted systems for security products.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"technique_id":"T1053.005","description":"TA2541 has used scheduled tasks to establish persistence for installed tools.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"technique_id":"T1055","description":"TA2541 has injected malicious code into legitimate .NET related processes including regsvcs.exe, msbuild.exe, and installutil.exe.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"},{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1055.012","description":"TA2541 has used process hollowing to execute CyberGate malware.","sources":[{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1059.001","description":"TA2541 has used PowerShell to download files and to inject into various Windows processes.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"technique_id":"T1059.005","description":"TA2541 has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"},{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1082","description":"TA2541 has collected system information prior to downloading malware on the targeted host.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"technique_id":"T1105","description":"TA2541 has used malicious scripts and macros with the ability to download additional payloads.","sources":[{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1204.001","description":"TA2541 has used malicious links to cloud and web services to gain execution on victim machines.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"},{"source":"FireEye NETWIRE March 2019","url":"https://www.mandiant.com/resources/blog/dissecting-netwire-phishing-campaigns-usage-process-hollowing"}]},{"technique_id":"T1204.002","description":"TA2541 has used macro-enabled MS Word documents to lure victims into executing malicious payloads.","sources":[{"source":"Telefonica Snip3 December 2021","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"},{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"},{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1218.005","description":"TA2541 has used mshta to execute scripts including VBS.","sources":[{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1518.001","description":"TA2541 has used tools to search victim systems for security products such as antivirus and firewall software.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"technique_id":"T1547.001","description":"TA2541 has placed VBS files in the Startup folder and used Registry run keys to establish persistence for malicious payloads.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"technique_id":"T1566.001","description":"TA2541 has sent phishing emails with malicious attachments for initial access including MS Word documents.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"},{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1566.002","description":"TA2541 has used spearphishing e-mails with malicious links to deliver malware.","sources":[{"source":"Telefonica Snip3 December 2021","url":"https://telefonicatech.com/blog/snip3-investigacion-malware"},{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"technique_id":"T1568","description":"TA2541 has used dynamic DNS services for C2 infrastructure.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"technique_id":"T1573.002","description":"TA2541 has used TLS encrypted C2 communications including for campaigns using AsyncRAT.","sources":[{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1583.001","description":"TA2541 has registered domains often containing the keywords “kimjoy,” “h0pe,” and “grace,” using domain registrars including Netdorm and No-IP DDNS, and hosting providers including xTom GmbH and Danilenko, Artyom.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"},{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1583.006","description":"TA2541 has hosted malicious files on various platforms including Google Drive, OneDrive, Discord, PasteText, ShareText, and GitHub.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"technique_id":"T1588.001","description":"TA2541 has used multiple strains of malware available for purchase on criminal forums or in open-source repositories.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]},{"technique_id":"T1588.002","description":"TA2541 has used commodity remote access tools.","sources":[{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1608.001","description":"TA2541 has uploaded malware to various platforms including Google Drive, Pastetext, Sharetext, and GitHub.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"},{"source":"Cisco Operation Layover September 2021","url":"https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/"}]},{"technique_id":"T1685","description":"TA2541 has attempted to disable built-in security protections such as Windows AMSI.","sources":[{"source":"Proofpoint TA2541 February 2022","url":"https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight"}]}]},{"id":"G0062","name":"TA459","procedures":[{"technique_id":"T1059.001","description":"TA459 has used PowerShell for execution of a payload.","sources":[{"source":"Proofpoint TA459 April 2017","url":"https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"}]},{"technique_id":"T1059.005","description":"TA459 has a VBScript for execution.","sources":[{"source":"Proofpoint TA459 April 2017","url":"https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"}]},{"technique_id":"T1203","description":"TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.","sources":[{"source":"Proofpoint TA459 April 2017","url":"https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"}]},{"technique_id":"T1204.002","description":"TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.","sources":[{"source":"Proofpoint TA459 April 2017","url":"https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"}]},{"technique_id":"T1566.001","description":"TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.","sources":[{"source":"Proofpoint TA459 April 2017","url":"https://www.proofpoint.com/us/threat-insight/post/apt-targets-financial-analysts"}]}]},{"id":"G0092","name":"TA505","procedures":[{"technique_id":"T1027.002","description":"TA505 has used UPX to obscure malicious code.","sources":[{"source":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"}]},{"technique_id":"T1027.010","description":"TA505 has used base64 encoded PowerShell commands.","sources":[{"source":"Cybereason TA505 April 2019","url":"https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"},{"source":"Deep Instinct TA505 Apr 2019","url":"https://www.deepinstinct.com/blog/new-servhelper-variant-employs-excel-4-0-macro-to-drop-signed-payload"}]},{"technique_id":"T1027.013","description":"TA505 has password-protected malicious Word documents.","sources":[{"source":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"}]},{"technique_id":"T1055.001","description":"TA505 has been seen injecting a DLL into winword.exe.","sources":[{"source":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"}]},{"technique_id":"T1059.001","description":"TA505 has used PowerShell to download and execute malware and reconnaissance scripts.","sources":[{"source":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"},{"source":"ProofPoint SettingContent-ms July 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-abusing-settingcontent-ms-within-pdf-files-distribute-flawedammyy-rat"},{"source":"Cybereason TA505 April 2019","url":"https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"},{"source":"Deep Instinct TA505 Apr 2019","url":"https://www.deepinstinct.com/blog/new-servhelper-variant-employs-excel-4-0-macro-to-drop-signed-payload"}]},{"technique_id":"T1059.003","description":"TA505 has executed commands using cmd.exe.","sources":[{"source":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"}]},{"technique_id":"T1059.005","description":"TA505 has used VBS for code execution.","sources":[{"source":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"},{"source":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"},{"source":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"},{"source":"Proofpoint TA505 June 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"}]},{"technique_id":"T1059.007","description":"TA505 has used JavaScript for code execution.","sources":[{"source":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"},{"source":"Proofpoint TA505 June 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"}]},{"technique_id":"T1069","description":"TA505 has used TinyMet to enumerate members of privileged groups. TA505 has also run net group /domain.","sources":[{"source":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"},{"source":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"}]},{"technique_id":"T1071.001","description":"TA505 has used HTTP to communicate with C2 nodes.","sources":[{"source":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"}]},{"technique_id":"T1078.002","description":"TA505 has used stolen domain admin accounts to compromise additional hosts.","sources":[{"source":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"}]},{"technique_id":"T1087.003","description":"TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.","sources":[{"source":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"}]},{"technique_id":"T1105","description":"TA505 has downloaded additional malware to execute on victim systems.","sources":[{"source":"ProofPoint SettingContent-ms July 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-abusing-settingcontent-ms-within-pdf-files-distribute-flawedammyy-rat"},{"source":"Cybereason TA505 April 2019","url":"https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"},{"source":"Deep Instinct TA505 Apr 2019","url":"https://www.deepinstinct.com/blog/new-servhelper-variant-employs-excel-4-0-macro-to-drop-signed-payload"}]},{"technique_id":"T1106","description":"TA505 has deployed payloads that use Windows API calls on a compromised host.","sources":[{"source":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"technique_id":"T1112","description":"TA505 has used malware to disable Windows Defender through modification of the Registry.","sources":[{"source":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"technique_id":"T1140","description":"TA505 has decrypted packed DLLs with an XOR key.","sources":[{"source":"NCC Group TA505","url":"https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/"}]},{"technique_id":"T1204.001","description":"TA505 has used lures to get users to click links in emails and attachments. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.","sources":[{"source":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"},{"source":"Proofpoint TA505 June 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"},{"source":"Proofpoint TA505 Jan 2019","url":"https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"},{"source":"Cybereason TA505 April 2019","url":"https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"},{"source":"ProofPoint SettingContent-ms July 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-abusing-settingcontent-ms-within-pdf-files-distribute-flawedammyy-rat"},{"source":"Proofpoint TA505 Mar 2018","url":"https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"},{"source":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"},{"source":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"technique_id":"T1204.002","description":"TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example, TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files.","sources":[{"source":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"},{"source":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"},{"source":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"},{"source":"ProofPoint SettingContent-ms July 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-abusing-settingcontent-ms-within-pdf-files-distribute-flawedammyy-rat"},{"source":"Proofpoint TA505 June 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"},{"source":"Proofpoint TA505 Mar 2018","url":"https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"},{"source":"Cybereason TA505 April 2019","url":"https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"},{"source":"Proofpoint TA505 Jan 2019","url":"https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"},{"source":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"technique_id":"T1218.007","description":"TA505 has used msiexec to download and execute malicious Windows Installer files.","sources":[{"source":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"},{"source":"Cybereason TA505 April 2019","url":"https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"},{"source":"Deep Instinct TA505 Apr 2019","url":"https://www.deepinstinct.com/blog/new-servhelper-variant-employs-excel-4-0-macro-to-drop-signed-payload"}]},{"technique_id":"T1218.011","description":"TA505 has leveraged rundll32.exe to execute malicious DLLs.","sources":[{"source":"Cybereason TA505 April 2019","url":"https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"},{"source":"Deep Instinct TA505 Apr 2019","url":"https://www.deepinstinct.com/blog/new-servhelper-variant-employs-excel-4-0-macro-to-drop-signed-payload"}]},{"technique_id":"T1486","description":"TA505 has used a wide variety of ransomware, such as Clop, Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.","sources":[{"source":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"}]},{"technique_id":"T1552.001","description":"TA505 has used malware to gather credentials from FTP clients and Outlook.","sources":[{"source":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"}]},{"technique_id":"T1553.002","description":"TA505 has signed payloads with code signing certificates from Thawte and Sectigo.","sources":[{"source":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"},{"source":"Cybereason TA505 April 2019","url":"https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"},{"source":"Deep Instinct TA505 Apr 2019","url":"https://www.deepinstinct.com/blog/new-servhelper-variant-employs-excel-4-0-macro-to-drop-signed-payload"}]},{"technique_id":"T1553.005","description":"TA505 has used .iso files to deploy malicious .lnk files.","sources":[{"source":"TrendMicro TA505 Aug 2019","url":"https://www.trendmicro.com/en_us/research/19/h/ta505-at-it-again-variety-is-the-spice-of-servhelper-and-flawedammyy.html"}]},{"technique_id":"T1555.003","description":"TA505 has used malware to gather credentials from Internet Explorer.","sources":[{"source":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"}]},{"technique_id":"T1559.002","description":"TA505 has leveraged malicious Word documents that abused DDE.","sources":[{"source":"Proofpoint TA505 June 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"}]},{"technique_id":"T1566.001","description":"TA505 has used spearphishing emails with malicious attachments to initially compromise victims.","sources":[{"source":"IBM TA505 April 2020","url":"https://web.archive.org/web/20200420201624/https://securityintelligence.com/posts/ta505-continues-to-infect-networks-with-sdbbot-rat/"},{"source":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"},{"source":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"},{"source":"ProofPoint SettingContent-ms July 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-abusing-settingcontent-ms-within-pdf-files-distribute-flawedammyy-rat"},{"source":"Proofpoint TA505 June 2018","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-shifts-times"},{"source":"Proofpoint TA505 Mar 2018","url":"https://www.proofpoint.com/us/threat-insight/post/leaked-ammyy-admin-source-code-turned-malware"},{"source":"Cybereason TA505 April 2019","url":"https://www.cybereason.com/blog/threat-actor-ta505-targets-financial-enterprises-using-lolbins-and-a-new-backdoor-malware"},{"source":"Proofpoint TA505 Jan 2019","url":"https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"},{"source":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"technique_id":"T1566.002","description":"TA505 has sent spearphishing emails containing malicious links.","sources":[{"source":"Proofpoint TA505 Sep 2017","url":"https://www.proofpoint.com/us/threat-insight/post/threat-actor-profile-ta505-dridex-globeimposter"},{"source":"Proofpoint TA505 Jan 2019","url":"https://www.proofpoint.com/us/threat-insight/post/servhelper-and-flawedgrace-new-malware-introduced-ta505"},{"source":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"},{"source":"Proofpoint TA505 October 2019","url":"https://www.proofpoint.com/us/threat-insight/post/ta505-distributes-new-sdbbot-remote-access-trojan-get2-downloader"}]},{"technique_id":"T1568.001","description":"TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.","sources":[{"source":"Trend Micro TA505 June 2019","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/shifting-tactics-breaking-down-ta505-groups-use-of-html-rats-and-other-techniques-in-latest-campaigns/"}]},{"technique_id":"T1583.001","description":"TA505 has registered domains to impersonate services such as Dropbox to distribute malware.","sources":[{"source":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"technique_id":"T1588.001","description":"TA505 has used malware such as Azorult and Cobalt Strike in their operations.","sources":[{"source":"NCC Group TA505","url":"https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/"}]},{"technique_id":"T1588.002","description":"TA505 has used a variety of tools in their operations, including AdFind, BloodHound, Mimikatz, and PowerSploit.","sources":[{"source":"NCC Group TA505","url":"https://research.nccgroup.com/2020/11/18/ta505-a-brief-history-of-their-time/"}]},{"technique_id":"T1608.001","description":"TA505 has staged malware on actor-controlled domains.","sources":[{"source":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]},{"technique_id":"T1685","description":"TA505 has used malware to disable Windows Defender.","sources":[{"source":"Korean FSI TA505 2020","url":"https://www.fsec.or.kr/user/bbs/fsec/163/344/bbsDataView/1382.do?page=1&column=&search=&searchSDate=&searchEDate=&bbsDataCategory="}]}]},{"id":"G0127","name":"TA551","procedures":[{"technique_id":"T1027.003","description":"TA551 has hidden encoded data for malware DLLs in a PNG.","sources":[{"source":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"}]},{"technique_id":"T1027.010","description":"TA551 has used obfuscated variable names in a JavaScript configuration file.","sources":[{"source":"Unit 42 Valak July 2020","url":"https://unit42.paloaltonetworks.com/valak-evolution/"}]},{"technique_id":"T1036","description":"TA551 has masked malware DLLs as dat and jpg files.","sources":[{"source":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"}]},{"technique_id":"T1059.003","description":"TA551 has used cmd.exe to execute commands.","sources":[{"source":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"}]},{"technique_id":"T1071.001","description":"TA551 has used HTTP for C2 communications.","sources":[{"source":"Unit 42 Valak July 2020","url":"https://unit42.paloaltonetworks.com/valak-evolution/"}]},{"technique_id":"T1105","description":"TA551 has retrieved DLLs and installer binaries for malware execution from C2.","sources":[{"source":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"}]},{"technique_id":"T1132.001","description":"TA551 has used encoded ASCII text for initial C2 communications.","sources":[{"source":"Unit 42 Valak July 2020","url":"https://unit42.paloaltonetworks.com/valak-evolution/"}]},{"technique_id":"T1204.002","description":"TA551 has prompted users to enable macros within spearphishing attachments to install malware.","sources":[{"source":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"}]},{"technique_id":"T1218.005","description":"TA551 has used mshta.exe to execute malicious payloads.","sources":[{"source":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"}]},{"technique_id":"T1218.010","description":"TA551 has used regsvr32.exe to load malicious DLLs.","sources":[{"source":"Unit 42 Valak July 2020","url":"https://unit42.paloaltonetworks.com/valak-evolution/"}]},{"technique_id":"T1218.011","description":"TA551 has used rundll32.exe to load malicious DLLs.","sources":[{"source":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"}]},{"technique_id":"T1566.001","description":"TA551 has sent spearphishing attachments with password protected ZIP files.","sources":[{"source":"Unit 42 Valak July 2020","url":"https://unit42.paloaltonetworks.com/valak-evolution/"},{"source":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"},{"source":"Secureworks GOLD CABIN","url":"https://www.secureworks.com/research/threat-profiles/gold-cabin"}]},{"technique_id":"T1568.002","description":"TA551 has used a DGA to generate URLs from executed macros.","sources":[{"source":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"},{"source":"Secureworks GOLD CABIN","url":"https://www.secureworks.com/research/threat-profiles/gold-cabin"}]},{"technique_id":"T1589.002","description":"TA551 has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.","sources":[{"source":"Unit 42 TA551 Jan 2021","url":"https://unit42.paloaltonetworks.com/ta551-shathak-icedid/"}]}]},{"id":"G1037","name":"TA577","procedures":[{"technique_id":"T1027.009","description":"TA577 has used LNK files to execute embedded DLLs.","sources":[{"source":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]},{"technique_id":"T1059.003","description":"TA577 has used BAT files in malware execution chains.","sources":[{"source":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]},{"technique_id":"T1059.007","description":"TA577 has used JavaScript to execute additional malicious payloads.","sources":[{"source":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]},{"technique_id":"T1204.001","description":"TA577 has lured users into executing malicious JavaScript files by sending malicious links via email.","sources":[{"source":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]},{"technique_id":"T1566.002","description":"TA577 has sent emails containing links to malicious JavaScript files.","sources":[{"source":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]},{"technique_id":"T1586.002","description":"TA577 has sent thread hijacked messages from compromised emails.","sources":[{"source":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]}]},{"id":"G1038","name":"TA578","procedures":[{"technique_id":"T1059.007","description":"TA578 has used JavaScript files in malware execution chains.","sources":[{"source":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]},{"technique_id":"T1204.001","description":"TA578 has placed malicious links in contact forms on victim sites, often spoofing a copyright complaint, to redirect users to malicious file downloads.","sources":[{"source":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]},{"technique_id":"T1583.006","description":"TA578 has used Google Firebase to host malicious scripts.","sources":[{"source":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]},{"technique_id":"T1594","description":"TA578 has filled out contact forms on victims' websites to direct them to adversary-controlled URLs.","sources":[{"source":"Latrodectus APR 2024","url":"https://www.proofpoint.com/us/blog/threat-insight/latrodectus-spider-bytes-ice"}]}]},{"id":"G1056","name":"TeamPCP","procedures":[{"technique_id":"T1005","description":"TeamPCP has stolen source code from victim environments including Mistral AI.","sources":[{"source":"Flashpoint Mini Shai-Hulud MAY 2026","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"}]},{"technique_id":"T1027.003","description":"TeamPCP has hidden malicious payloads in the frame data of WAV audio files.","sources":[{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"technique_id":"T1036.005","description":"TeamPCP has cloned GitHub commit metadata including the author name, email, committer, and timestamps to use for impostor commits. TeamPCP has also used legitimate file names such as msbuild.exe and ringtone.wav to mask malicious payloads.","sources":[{"source":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"technique_id":"T1059.004","description":"TeamPCP has leveraged malware capable of execution via the Linux CLI.","sources":[{"source":"Hunt.io TeamPCP Toolkit MAY 2026","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"}]},{"technique_id":"T1059.006","description":"TeamPCP has poisoned PyPi packages with malicious code and has used a 13 file modular Python framework for data collection.","sources":[{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source":"Hunt.io TeamPCP Toolkit MAY 2026","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"},{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"}]},{"technique_id":"T1059.007","description":"TeamPCP has used the JavaScript runtime for malware delivery and injected malicious JavaScript into OpenVSX extensions.","sources":[{"source":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"}]},{"technique_id":"T1059.013","description":"TeamPCP has queried the Kubernetes API for local service account tokens and has used kubectl for lateral movement.","sources":[{"source":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source":"Phoenix TeamPCP 20 MAY 2026","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"technique_id":"T1078","description":"TeamPCP has compromised credentials associated with open source security scanning tools and used them to push malicious code to all the resources the tools had access to.","sources":[{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"}]},{"technique_id":"T1078.004","description":"TeamPCP has used compromised credentials for GitHub and software package repositories, including privileged service accounts, to inject malicious code into CI/CD pipelines.","sources":[{"source":"Aqua Security Trivy Compromise MAR 2026","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"},{"source":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source":"Wiz Mini Shai-Hulud MAY 2026","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"},{"source":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"},{"source":"Phoenix TeamPCP 20 MAY 2026","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"technique_id":"T1098","description":"TeamPCP has modified settings to publish private Aqua Security repositories to GitHub as public.","sources":[{"source":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"}]},{"technique_id":"T1105","description":"TeamPCP has modified legitimate software binaries to retrieve secondary payloads from C2.","sources":[{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}]},{"technique_id":"T1176.002","description":"TeamPCP has compromised VS Code and Open VSX IDE extensions.","sources":[{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source":"Flashpoint Mini Shai-Hulud MAY 2026","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"},{"source":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source":"Phoenix TeamPCP 20 MAY 2026","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"technique_id":"T1190","description":"TeamPCP has exploited misconfigurations in GitHub Actions and vulnerabilities such as CVE-2026-33634 in the Aqua Security Trivy scanner and CVE-2025-55182 (React2Shell) against vulnerable cloud endpoints.","sources":[{"source":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source":"Wiz Mini Shai-Hulud MAY 2026","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"technique_id":"T1195.001","description":"TeamPCP has conducted coordinated supply chain attacks targeting open-source developer infrastructure including the NPM, VS Code, Docker, and PyPi ecosystems to compromise multiple software packages.","sources":[{"source":"Aqua Security Trivy Compromise MAR 2026","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"},{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source":"FBI TeamPCP JUL 2026","url":"https://www.ic3.gov/CSA/2026/260702.pdf"},{"source":"Flashpoint Mini Shai-Hulud MAY 2026","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"},{"source":"Google AI Threat Tracker MAY 2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access"},{"source":"Hunt.io TeamPCP Toolkit MAY 2026","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"},{"source":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source":"Wiz Mini Shai-Hulud MAY 2026","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"},{"source":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"},{"source":"Phoenix TeamPCP 20 MAY 2026","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"technique_id":"T1485","description":"TeamPCP has deployed privileged DaemonSets to delete files on Kubernetes clusters and has executed recursive file deletions on non-containerized hosts.","sources":[{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"technique_id":"T1486","description":"TeamPCP has deployed ransomware and has announced partnerships with ransomware groups including Vect and CipherForce in online criminal forums.","sources":[{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"technique_id":"T1528","description":"TeamPCP has used malware to steal access tokens from targeted cloud and developer environments.","sources":[{"source":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source":"FBI TeamPCP JUL 2026","url":"https://www.ic3.gov/CSA/2026/260702.pdf"},{"source":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"technique_id":"T1543.002","description":"TeamPCP has used the systemd user service for malware persistence in targeted environments.","sources":[{"source":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"}]},{"technique_id":"T1546.016","description":"TeamPCP has modified software packages with preinstall scripts to download and execute malicious payloads.","sources":[{"source":"Wiz Mini Shai-Hulud MAY 2026","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"}]},{"technique_id":"T1547.001","description":"TeamPCP has dropped malware into the Windows Startup folder to establish persistence.","sources":[{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"}]},{"technique_id":"T1550.001","description":"TeamPCP has used stolen access tokens to inject malicious code into CI/CD workflows and to exfiltrate sensitive data from cloud, developer, and container environments.","sources":[{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"technique_id":"T1552.004","description":"TeamPCP has used malware to extract SSH and GPG keys from victim environments.","sources":[{"source":"FBI TeamPCP JUL 2026","url":"https://www.ic3.gov/CSA/2026/260702.pdf"},{"source":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"technique_id":"T1553.002","description":"TeamPCP has compromised legitimate software release workflows resulting in malicious packages receiving legitimate project cryptographic signing.","sources":[{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"}]},{"technique_id":"T1555.006","description":"TeamPCP has used malware to exfiltrate cloud secrets from targeted environments including AWS, GCP, and Azure.","sources":[{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source":"FBI TeamPCP JUL 2026","url":"https://www.ic3.gov/CSA/2026/260702.pdf"},{"source":"Sysdig TeamPCP MAR 2026","url":"https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"}]},{"technique_id":"T1564.001","description":"TeamPCP has used a hidden .lock file to establish a 12 hour cooldown period between re-drops for installed malware.","sources":[{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"}]},{"technique_id":"T1583","description":"In May 2026 TeamPCP announced co-ownership of the BreachForums cybercriminal forum claiming responsibility for platform operations, dispute resolution, personnel vetting, and hosting monetary contests.","sources":[{"source":"Flashpoint Mini Shai-Hulud MAY 2026","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"}]},{"technique_id":"T1583.001","description":"TeamPCP has registered domains resembling legitimate victim sites such as scan.aquasecurtiy.]org, checkmarx[.]zone, and git-tanstack[.]com to mask C2 and exfiltration endpoints. [TeamPCP has also set up a dark web leak site to post stolen data.","sources":[{"source":"Aqua Security Trivy Compromise MAR 2026","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"},{"source":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source":"FBI TeamPCP JUL 2026","url":"https://www.ic3.gov/CSA/2026/260702.pdf"},{"source":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source":"Wiz Mini Shai-Hulud MAY 2026","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"},{"source":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source":"Sysdig TeamPCP MAR 2026","url":"https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"},{"source":"Phoenix TeamPCP 20 MAY 2026","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"technique_id":"T1583.004","description":"TeamPCP has leased infrastructure specifically for offensive operations including Google assets in AS396982.","sources":[{"source":"FBI TeamPCP JUL 2026","url":"https://www.ic3.gov/CSA/2026/260702.pdf"},{"source":"Hunt.io TeamPCP Toolkit MAY 2026","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"}]},{"technique_id":"T1583.006","description":"TeamPCP has set up Clouflare Tunnels for malware C2. TeamPCP has also used the session messenger network for decentralized, encrypted exfiltration via *.getsession[.]org to recipient ID 05f9e609d79eed391015e11380dee4b5c9ead0b6e2e7f0134e6e51767a87323026.","sources":[{"source":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source":"Wiz Mini Shai-Hulud MAY 2026","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"},{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"}]},{"technique_id":"T1585.001","description":"TeamPCP has used its own Telegram channel and X accounts @pcpcats and @xploitrsturtle2 for external communications.","sources":[{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"},{"source":"Phoenix TeamPCP 20 MAY 2026","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"technique_id":"T1587.001","description":"TeamPCP has developed and deployed custom malware including TeamPCP Cloud Stealer, CanisterWorm, and Mini Shai-Hulud.","sources":[{"source":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"}]},{"technique_id":"T1608.001","description":"TeamPCP has pushed GitHub commits that modified the actions/checkout to reference an imposter commit that downloaded malicious files from attacker-controlled C2 domains.","sources":[{"source":"Aqua Security Trivy Compromise MAR 2026","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"}]},{"technique_id":"T1657","description":"TeamPCP has engaged in cryptocurrency mining and theft. TeamPCP has also partnered with ransomware and data theft extortion groups, sold leaked code, and crowdsourced supply chain compromises by open-sourcing their Mini Shai-Hulud malware.","sources":[{"source":"FBI TeamPCP JUL 2026","url":"https://www.ic3.gov/CSA/2026/260702.pdf"},{"source":"Flashpoint Mini Shai-Hulud MAY 2026","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"},{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"},{"source":"Phoenix TeamPCP 20 MAY 2026","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"technique_id":"T1677","description":"TeamPCP has compromised trusted CI/CD pipelines by injecting credential-stealing payloads into legitimate workflows and software packages including open-source security tools Trivy and KICS, and AI gateway LiteLLM.","sources":[{"source":"Aqua Security Trivy Compromise MAR 2026","url":"https://github.com/aquasecurity/trivy/security/advisories/GHSA-69fq-xp46-6x23"},{"source":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source":"Aikido TeamPCP Telnyx MAR 2026","url":"https://www.aikido.dev/blog/telnyx-pypi-compromised-teampcp-canisterworm"},{"source":"FBI TeamPCP JUL 2026","url":"https://www.ic3.gov/CSA/2026/260702.pdf"},{"source":"Flashpoint Mini Shai-Hulud MAY 2026","url":"https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/"},{"source":"Google AI Threat Tracker MAY 2026","url":"https://cloud.google.com/blog/topics/threat-intelligence/ai-vulnerability-exploitation-initial-access"},{"source":"Hunt.io TeamPCP Toolkit MAY 2026","url":"https://hunt.io/blog/teampcp-python-toolkit-firescale-github-c2-takedown"},{"source":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"},{"source":"Wiz Mini Shai-Hulud MAY 2026","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"},{"source":"Wiz TeamPCP KICS MAR 2026","url":"https://www.wiz.io/blog/teampcp-attack-kics-github-action"},{"source":"Trend Micro TeamPCP MAY 2026","url":"https://www.trendmicro.com/en_us/research/26/e/analyzing-teampcp-supply-chain-attacks.html"},{"source":"Sysdig TeamPCP MAR 2026","url":"https://www.sysdig.com/blog/teampcp-expands-supply-chain-compromise-spreads-from-trivy-to-checkmarx-github-actions"},{"source":"Palo Alto TeamPCP MAR 2026","url":"https://unit42.paloaltonetworks.com/teampcp-supply-chain-attacks/"},{"source":"Phoenix TeamPCP 20 MAY 2026","url":"https://phoenix.security/teampcp-github-breach-durabletask-pypi-supply-chain-wave-four-2026/"}]},{"technique_id":"T1683.001","description":"TeamPCP has created Dune-themed GitHub repositories using stolen tokens.","sources":[{"source":"Wiz Mini Shai-Hulud MAY 2026","url":"https://www.wiz.io/blog/mini-shai-hulud-strikes-again-tanstack-more-npm-packages-compromised"}]},{"technique_id":"T1684.001","description":"TeamPCP impersonated legitimate maintainers to push imposter commits to the Aquasecurity Trivy scanner GitHub repository.","sources":[{"source":"Aqua Security Blog Trivy Compromise APR 2026","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"},{"source":"Wiz Trivy Compromise MAR 2026","url":"https://www.wiz.io/blog/trivy-compromised-teampcp-supply-chain-attack"}]}]},{"id":"G0139","name":"TeamTNT","procedures":[{"technique_id":"T1007","description":"TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1014","description":"TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1016","description":"TeamTNT has enumerated the host machine’s IP address.","sources":[{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1021.004","description":"TeamTNT has used SSH to connect back to victim machines. TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Intezer TeamTNT September 2020","url":"https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"}]},{"technique_id":"T1027.002","description":"TeamTNT has used UPX and Ezuri packer to pack its binaries.","sources":[{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1027.013","description":"TeamTNT has encrypted its binaries via AES and encoded files using Base64.","sources":[{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"},{"source":"Aqua TeamTNT August 2020","url":"https://blog.aquasec.com/container-security-tnt-container-attack"}]},{"technique_id":"T1036","description":"TeamTNT has disguised their scripts with docker-related file names.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1036.005","description":"TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1046","description":"TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters. TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.","sources":[{"source":"Cado Security TeamTNT Worm August 2020","url":"https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/"},{"source":"Unit 42 Hildegard Malware","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"},{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Palo Alto Black-T October 2020","url":"https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/"}]},{"technique_id":"T1048","description":"TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1049","description":"TeamTNT has run netstat -anp to search for rival malware connections. TeamTNT has also used libprocesshider to modify /etc/ld.so.preload.","sources":[{"source":"ATT TeamTNT Chimaera September 2020","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1057","description":"TeamTNT has searched for rival malware and removes it if found. TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1059.001","description":"TeamTNT has executed PowerShell commands in batch scripts.","sources":[{"source":"ATT TeamTNT Chimaera September 2020","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"}]},{"technique_id":"T1059.003","description":"TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.","sources":[{"source":"ATT TeamTNT Chimaera September 2020","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"}]},{"technique_id":"T1059.004","description":"TeamTNT has used shell scripts for execution.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1059.009","description":"TeamTNT has leveraged AWS CLI to enumerate cloud environments with compromised credentials.","sources":[{"source":"Talos TeamTNT","url":"https://blog.talosintelligence.com/2022/04/teamtnt-targeting-aws-alibaba.html"}]},{"technique_id":"T1059.013","description":"TeamTNT targeted misconfigured containers and used container CLI tools.","sources":[{"source":"Cisco Talos Blog","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1070.003","description":"TeamTNT has cleared command history with history -c.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1070.004","description":"TeamTNT has used a payload that removes itself after running. TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.","sources":[{"source":"ATT TeamTNT Chimaera September 2020","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"},{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1071","description":"TeamTNT has used an IRC bot for C2 communications.","sources":[{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1071.001","description":"TeamTNT has the curl command to send credentials over HTTP and the curl and wget commands to download new software. TeamTNT has also used a custom user agent HTTP header in shell scripts.","sources":[{"source":"Cado Security TeamTNT Worm August 2020","url":"https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/"},{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"},{"source":"Intezer TeamTNT September 2020","url":"https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"}]},{"technique_id":"T1074.001","description":"TeamTNT has aggregated collected credentials in text files before exfiltrating.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1082","description":"TeamTNT has searched for system version, architecture, and hostname information.","sources":[{"source":"ATT TeamTNT Chimaera September 2020","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"},{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1083","description":"TeamTNT has used a script that checks /proc/*/environ for environment variables related to AWS.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1098.004","description":"TeamTNT has added RSA keys in authorized_keys.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Aqua TeamTNT August 2020","url":"https://blog.aquasec.com/container-security-tnt-container-attack"}]},{"technique_id":"T1102","description":"TeamTNT has leveraged iplogger.org to send collected data back to C2.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Aqua TeamTNT August 2020","url":"https://blog.aquasec.com/container-security-tnt-container-attack"}]},{"technique_id":"T1105","description":"TeamTNT has the curl and wget commands as well as batch scripts to download new tools.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Intezer TeamTNT September 2020","url":"https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"}]},{"technique_id":"T1120","description":"TeamTNT has searched for attached VGA devices using lspci.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1133","description":"TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments. TeamTNT has also targeted exposed kubelets for Kubernetes environments.","sources":[{"source":"Unit 42 Hildegard Malware","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"},{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Intezer TeamTNT September 2020","url":"https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"}]},{"technique_id":"T1136.001","description":"TeamTNT has created local privileged users on victim machines.","sources":[{"source":"Intezer TeamTNT September 2020","url":"https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"}]},{"technique_id":"T1140","description":"TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1204.003","description":"TeamTNT has relied on users to download and execute malicious Docker images.","sources":[{"source":"Lacework TeamTNT May 2021","url":"https://www.lacework.com/blog/taking-teamtnt-docker-images-offline"}]},{"technique_id":"T1219","description":"TeamTNT has established tmate sessions for C2 communications.","sources":[{"source":"Unit 42 Hildegard Malware","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"},{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1222.002","description":"TeamTNT has modified the permissions on binaries with chattr.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1496.001","description":"TeamTNT has deployed XMRig Docker images to mine cryptocurrency. TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.","sources":[{"source":"Cado Security TeamTNT Worm August 2020","url":"https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/"},{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Lacework TeamTNT May 2021","url":"https://www.lacework.com/blog/taking-teamtnt-docker-images-offline"}]},{"technique_id":"T1518.001","description":"TeamTNT has searched for security products on infected machines.","sources":[{"source":"ATT TeamTNT Chimaera September 2020","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"},{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1543.002","description":"TeamTNT has established persistence through the creation of a cryptocurrency mining system service using systemctl.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1543.003","description":"TeamTNT has used malware that adds cryptocurrency miners as a service.","sources":[{"source":"ATT TeamTNT Chimaera September 2020","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"}]},{"technique_id":"T1547.001","description":"TeamTNT has added batch scripts to the startup folder.","sources":[{"source":"ATT TeamTNT Chimaera September 2020","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"}]},{"technique_id":"T1552.001","description":"TeamTNT has searched for unsecured AWS credentials and Docker API credentials.","sources":[{"source":"Cado Security TeamTNT Worm August 2020","url":"https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/"},{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1552.004","description":"TeamTNT has searched for unsecured SSH keys.","sources":[{"source":"Cado Security TeamTNT Worm August 2020","url":"https://www.cadosecurity.com/team-tnt-the-first-crypto-mining-worm-to-steal-aws-credentials/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1552.005","description":"TeamTNT has queried the AWS instance metadata service for credentials.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1569.003","description":"TeamTNT has created system services to execute cryptocurrency mining software.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1583.001","description":"TeamTNT has obtained domains to host their payloads.","sources":[{"source":"Palo Alto Black-T October 2020","url":"https://unit42.paloaltonetworks.com/black-t-cryptojacking-variant/"}]},{"technique_id":"T1587.001","description":"TeamTNT has developed custom malware such as Hildegard.","sources":[{"source":"Unit 42 Hildegard Malware","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"technique_id":"T1595.001","description":"TeamTNT has scanned specific lists of target IP addresses.","sources":[{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1595.002","description":"TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.","sources":[{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1608.001","description":"TeamTNT has uploaded backdoored Docker images to Docker Hub.","sources":[{"source":"Lacework TeamTNT May 2021","url":"https://www.lacework.com/blog/taking-teamtnt-docker-images-offline"}]},{"technique_id":"T1609","description":"TeamTNT executed Hildegard through the kubelet API run command and by executing commands on running containers.","sources":[{"source":"Unit 42 Hildegard Malware","url":"https://unit42.paloaltonetworks.com/hildegard-malware-teamtnt/"}]},{"technique_id":"T1610","description":"TeamTNT has deployed different types of containers into victim environments to facilitate execution. TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"},{"source":"Intezer TeamTNT September 2020","url":"https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"}]},{"technique_id":"T1611","description":"TeamTNT has deployed privileged containers that mount the filesystem of victim machine.","sources":[{"source":"Intezer TeamTNT September 2020","url":"https://www.intezer.com/blog/cloud-security/attackers-abusing-legitimate-cloud-monitoring-tools-to-conduct-cyber-attacks/"},{"source":"Aqua TeamTNT August 2020","url":"https://blog.aquasec.com/container-security-tnt-container-attack"}]},{"technique_id":"T1613","description":"TeamTNT has checked for running containers with docker ps and for specific container names with docker inspect. TeamTNT has also searched for Kubernetes pods running in a local network.","sources":[{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"},{"source":"Trend Micro TeamTNT","url":"https://documents.trendmicro.com/assets/white_papers/wp-tracking-the-activities-of-teamTNT.pdf"}]},{"technique_id":"T1680","description":"TeamTNT has searched for disk partition and logical volume information.","sources":[{"source":"ATT TeamTNT Chimaera September 2020","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"},{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1685","description":"TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.","sources":[{"source":"ATT TeamTNT Chimaera September 2020","url":"https://cybersecurity.att.com/blogs/labs-research/teamtnt-with-new-campaign-aka-chimaera"},{"source":"Cisco Talos Intelligence Group","url":"https://blog.talosintelligence.com/teamtnt-targeting-aws-alibaba-2/"}]},{"technique_id":"T1685.006","description":"TeamTNT has removed system logs from /var/log/syslog.","sources":[{"source":"Aqua TeamTNT August 2020","url":"https://blog.aquasec.com/container-security-tnt-container-attack"}]},{"technique_id":"T1686","description":"TeamTNT has disabled iptables.","sources":[{"source":"Aqua TeamTNT August 2020","url":"https://blog.aquasec.com/container-security-tnt-container-attack"}]}]},{"id":"G0088","name":"TEMP.Veles","procedures":[]},{"id":"G0089","name":"The White Company","procedures":[{"technique_id":"T1027.002","description":"The White Company has obfuscated their payloads through packing.","sources":[{"source":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]},{"technique_id":"T1070.004","description":"The White Company has the ability to delete its malware entirely from the target system.","sources":[{"source":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]},{"technique_id":"T1124","description":"The White Company has checked the current date on the victim system.","sources":[{"source":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]},{"technique_id":"T1203","description":"The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.","sources":[{"source":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]},{"technique_id":"T1204.002","description":"The White Company has used phishing lure documents that trick users into opening them and infecting their computers.","sources":[{"source":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]},{"technique_id":"T1518.001","description":"The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.","sources":[{"source":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]},{"technique_id":"T1566.001","description":"The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.","sources":[{"source":"Cylance Shaheen Nov 2018","url":"https://www.cylance.com/content/dam/cylance-web/en-us/resources/knowledge-center/resource-library/reports/WhiteCompanyOperationShaheenReport.pdf?_ga=2.161661948.1943296560.1555683782-1066572390.1555511517"}]}]},{"id":"G0028","name":"Threat Group-1314","procedures":[{"technique_id":"T1021.002","description":"Threat Group-1314 actors mapped network drives using net use.","sources":[{"source":"Dell TG-1314","url":"https://web.archive.org/web/20150626073312/http://www.secureworks.com/resources/blog/living-off-the-land/"}]},{"technique_id":"T1059.003","description":"Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.","sources":[{"source":"Dell TG-1314","url":"https://web.archive.org/web/20150626073312/http://www.secureworks.com/resources/blog/living-off-the-land/"}]},{"technique_id":"T1072","description":"Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.","sources":[{"source":"Dell TG-1314","url":"https://web.archive.org/web/20150626073312/http://www.secureworks.com/resources/blog/living-off-the-land/"}]},{"technique_id":"T1078.002","description":"Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.","sources":[{"source":"Dell TG-1314","url":"https://web.archive.org/web/20150626073312/http://www.secureworks.com/resources/blog/living-off-the-land/"}]}]},{"id":"G0027","name":"Threat Group-3390","procedures":[{"technique_id":"T1003.001","description":"Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1003.002","description":"Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1003.004","description":"Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1005","description":"Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1012","description":"A Threat Group-3390 tool can read and decrypt stored Registry values.","sources":[{"source":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"technique_id":"T1016","description":"Threat Group-3390 actors use NBTscan to discover vulnerable systems.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}]},{"technique_id":"T1018","description":"Threat Group-3390 has used the net view command.","sources":[{"source":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"technique_id":"T1021.006","description":"Threat Group-3390 has used WinRM to enable remote execution.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1027.002","description":"Threat Group-3390 has packed malware and tools, including using VMProtect.","sources":[{"source":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"},{"source":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"technique_id":"T1027.013","description":"A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder.","sources":[{"source":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"},{"source":"Securelist LuckyMouse June 2018","url":"https://securelist.com/luckymouse-hits-national-data-center/86083/"},{"source":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"technique_id":"T1027.015","description":"Threat Group-3390 malware is compressed with LZNT1 compression.","sources":[{"source":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"},{"source":"Securelist LuckyMouse June 2018","url":"https://securelist.com/luckymouse-hits-national-data-center/86083/"},{"source":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"technique_id":"T1030","description":"Threat Group-3390 actors have split RAR files for exfiltration into parts.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}]},{"technique_id":"T1033","description":"Threat Group-3390 has used whoami to collect system user information.","sources":[{"source":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"technique_id":"T1046","description":"Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}]},{"technique_id":"T1047","description":"A Threat Group-3390 tool can use WMI to execute a binary.","sources":[{"source":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"technique_id":"T1049","description":"Threat Group-3390 has used net use and netstat to conduct internal discovery of systems. The group has also used quser.exe to identify existing RDP sessions on a victim.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1053.002","description":"Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}]},{"technique_id":"T1055.012","description":"A Threat Group-3390 tool can spawn svchost.exe and inject the payload into that process.","sources":[{"source":"Securelist LuckyMouse June 2018","url":"https://securelist.com/luckymouse-hits-national-data-center/86083/"},{"source":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"technique_id":"T1056.001","description":"Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source":"Hacker News LuckyMouse June 2018","url":"https://thehackernews.com/2018/06/chinese-watering-hole-attack.html"},{"source":"Securelist LuckyMouse June 2018","url":"https://securelist.com/luckymouse-hits-national-data-center/86083/"}]},{"technique_id":"T1059.001","description":"Threat Group-3390 has used PowerShell for execution.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"},{"source":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"technique_id":"T1059.003","description":"Threat Group-3390 has used command-line interfaces for execution.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"},{"source":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}]},{"technique_id":"T1068","description":"Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"},{"source":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"}]},{"technique_id":"T1070.004","description":"Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"},{"source":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"technique_id":"T1070.005","description":"Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1071.001","description":"Threat Group-3390 malware has used HTTP for C2.","sources":[{"source":"Securelist LuckyMouse June 2018","url":"https://securelist.com/luckymouse-hits-national-data-center/86083/"}]},{"technique_id":"T1074.001","description":"Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1074.002","description":"Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1078","description":"Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}]},{"technique_id":"T1087.001","description":"Threat Group-3390 has used net user to conduct internal discovery of systems.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1105","description":"Threat Group-3390 has downloaded additional malware and tools, including through the use of certutil, onto a compromised host .","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"technique_id":"T1112","description":"A Threat Group-3390 tool has created new Registry keys under HKEY_CURRENT_USER\\Software\\Classes\\ and HKLM\\SYSTEM\\CurrentControlSet\\services.","sources":[{"source":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"},{"source":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"technique_id":"T1119","description":"Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1133","description":"Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services. Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1140","description":"During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.","sources":[{"source":"Securelist LuckyMouse June 2018","url":"https://securelist.com/luckymouse-hits-national-data-center/86083/"}]},{"technique_id":"T1189","description":"Threat Group-3390 has extensively used strategic web compromises to target victims.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source":"Securelist LuckyMouse June 2018","url":"https://securelist.com/luckymouse-hits-national-data-center/86083/"}]},{"technique_id":"T1190","description":"Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.","sources":[{"source":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"technique_id":"T1195.002","description":"Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.","sources":[{"source":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"technique_id":"T1199","description":"Threat Group-3390 has compromised third party service providers to gain access to victim's environments.","sources":[{"source":"Profero APT27 December 2020","url":"https://web.archive.org/web/20210104144857/https://shared-public-reports.s3-eu-west-1.amazonaws.com/APT27+turns+to+ransomware.pdf"}]},{"technique_id":"T1203","description":"Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.","sources":[{"source":"Trend Micro Iron Tiger April 2021","url":"https://www.trendmicro.com/en_us/research/21/d/iron-tiger-apt-updates-toolkit-with-evolved-sysupdate-malware-va.html"}]},{"technique_id":"T1204.002","description":"Threat Group-3390 has lured victims into opening malicious files containing malware.","sources":[{"source":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"technique_id":"T1210","description":"Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.","sources":[{"source":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}]},{"technique_id":"T1505.003","description":"Threat Group-3390 has used a variety of Web shells.","sources":[{"source":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}]},{"technique_id":"T1543.003","description":"Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.","sources":[{"source":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"},{"source":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"technique_id":"T1547.001","description":"Threat Group-3390's malware can add a Registry key to Software\\Microsoft\\Windows\\CurrentVersion\\Run for persistence.","sources":[{"source":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"},{"source":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"technique_id":"T1548.002","description":"A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.","sources":[{"source":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"technique_id":"T1555.005","description":"Threat Group-3390 obtained a KeePass database from a compromised host.","sources":[{"source":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"technique_id":"T1560.002","description":"Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]},{"technique_id":"T1566.001","description":"Threat Group-3390 has used e-mail to deliver malicious attachments to victims.","sources":[{"source":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"technique_id":"T1567.002","description":"Threat Group-3390 has exfiltrated stolen data to Dropbox.","sources":[{"source":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"technique_id":"T1574.001","description":"Threat Group-3390 has performed DLL search order hijacking to execute their payload. Threat Group-3390 has also used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as rc.exe, a legitimate Microsoft Resource Compiler.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"},{"source":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"},{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"},{"source":"Securelist LuckyMouse June 2018","url":"https://securelist.com/luckymouse-hits-national-data-center/86083/"},{"source":"Nccgroup Emissary Panda May 2018","url":"https://research.nccgroup.com/2018/05/18/emissary-panda-a-potential-new-malicious-tool/"}]},{"technique_id":"T1583.001","description":"Threat Group-3390 has registered domains for C2.","sources":[{"source":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"}]},{"technique_id":"T1588.002","description":"Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"},{"source":"Unit42 Emissary Panda May 2019","url":"https://unit42.paloaltonetworks.com/emissary-panda-attacks-middle-east-government-sharepoint-servers/"}]},{"technique_id":"T1588.003","description":"Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.","sources":[{"source":"Lunghi Iron Tiger Linux","url":"https://www.trendmicro.com/en_us/research/23/c/iron-tiger-sysupdate-adds-linux-targeting.html"}]},{"technique_id":"T1608.001","description":"Threat Group-3390 has hosted malicious payloads on Dropbox.","sources":[{"source":"Trend Micro DRBControl February 2020","url":"https://documents.trendmicro.com/assets/white_papers/wp-uncovering-DRBcontrol.pdf"}]},{"technique_id":"T1608.002","description":"Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.","sources":[{"source":"Dell TG-3390","url":"https://www.secureworks.com/research/threat-group-3390-targets-organizations-for-cyberespionage"}]},{"technique_id":"T1608.004","description":"Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.","sources":[]},{"technique_id":"T1685.001","description":"Threat Group-3390 has used appcmd.exe to disable logging on a victim server.","sources":[{"source":"SecureWorks BRONZE UNION June 2017","url":"https://www.secureworks.com/research/bronze-union"}]}]},{"id":"G0076","name":"Thrip","procedures":[{"technique_id":"T1048.003","description":"Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.","sources":[{"source":"Symantec Thrip June 2018","url":"https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets"}]},{"technique_id":"T1059.001","description":"Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.","sources":[{"source":"Symantec Thrip June 2018","url":"https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets"}]},{"technique_id":"T1219.002","description":"Thrip used a cloud-based remote access software called LogMeIn for their attacks.","sources":[{"source":"Symantec Thrip June 2018","url":"https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets"}]},{"technique_id":"T1588.002","description":"Thrip has obtained and used tools such as Mimikatz and PsExec.","sources":[{"source":"Symantec Thrip June 2018","url":"https://www.symantec.com/blogs/threat-intelligence/thrip-hits-satellite-telecoms-defense-targets"}]}]},{"id":"G1022","name":"ToddyCat","procedures":[{"technique_id":"T1005","description":"ToddyCat has run scripts to collect documents from targeted hosts.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1018","description":"ToddyCat has used ping %REMOTE_HOST% for post exploit discovery.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1021.002","description":"ToddyCat has used locally mounted network shares for lateral movement through targated environments.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1036.005","description":"ToddyCat has used the name debug.exe for malware components.","sources":[{"source":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}]},{"technique_id":"T1047","description":"ToddyCat has used WMI to execute scripts for post exploit document collection.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1049","description":"ToddyCat has used netstat -anop tcp to discover TCP connections to compromised hosts.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1053.005","description":"ToddyCat has used scheduled tasks to execute discovery commands and scripts for collection.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1057","description":"ToddyCat has run cmd /c start /b tasklist to enumerate processes.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1059.001","description":"ToddyCat has used Powershell scripts to perform post exploit collection.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1059.003","description":"ToddyCat has used .bat scripts and cmd for execution on compromised hosts.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1069.002","description":"ToddyCat has executed net group \"domain admins\" /dom for discovery on compromised machines.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1074.002","description":"ToddyCat manually transferred collected files to an exfiltration host using xcopy.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1078.002","description":"ToddyCat has used compromised domain admin credentials to mount local network shares.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1083","description":"ToddyCat has run scripts to enumerate recently modified documents having either a .pdf, .doc, .docx, .xls or .xlsx extension.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1087.002","description":"ToddyCat has run net user %USER% /dom for account discovery.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1095","description":"ToddyCat has used a passive backdoor that receives commands with UDP packets.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1106","description":"ToddyCat has used WinExec to execute commands received from C2 on compromised hosts.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1190","description":"ToddyCat has exploited the ProxyLogon vulnerability (CVE-2021-26855) to compromise Exchange Servers at multiple organizations.","sources":[{"source":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}]},{"technique_id":"T1518.001","description":"ToddyCat can determine is Kaspersky software is running on an endpoint by running cmd /c wmic process where name=\"avp.exe\".","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1560.001","description":"ToddyCat has leveraged xcopy, 7zip, and RAR to stage and compress collected documents prior to exfiltration.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1564.003","description":"ToddyCat has hidden malicious scripts using powershell.exe -windowstyle hidden.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1566.003","description":"ToddyCat has sent loaders configured to run Ninja as zip archives via Telegram.","sources":[{"source":"Kaspersky ToddyCat June 2022","url":"https://securelist.com/toddycat/106799/"}]},{"technique_id":"T1567.002","description":"ToddyCat has used a DropBox uploader to exfiltrate stolen files.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1680","description":"ToddyCat has collected information on bootable drives including model, vendor, and serial numbers.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]},{"technique_id":"T1686","description":"Prior to executing a backdoor ToddyCat has run cmd /c start /b netsh advfirewall firewall add rule name=\"SGAccessInboundRule\" dir=in protocol=udp action=allow localport=49683 to allow the targeted system to receive UDP packets on port 49683.","sources":[{"source":"Kaspersky ToddyCat Check Logs October 2023","url":"https://securelist.com/toddycat-keep-calm-and-check-logs/110696/"}]}]},{"id":"G0131","name":"Tonto Team","procedures":[{"technique_id":"T1003","description":"Tonto Team has used a variety of credential dumping tools.","sources":[{"source":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"technique_id":"T1056.001","description":"Tonto Team has used keylogging tools in their operations.","sources":[{"source":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"technique_id":"T1059.001","description":"Tonto Team has used PowerShell to download additional payloads.","sources":[{"source":"ESET Exchange Mar 2021","url":"https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/"}]},{"technique_id":"T1059.006","description":"Tonto Team has used Python-based tools for execution.","sources":[{"source":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"technique_id":"T1068","description":"Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.","sources":[{"source":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"technique_id":"T1069.001","description":"Tonto Team has used the ShowLocalGroupDetails command to identify administrator, user, and guest accounts on a compromised host.","sources":[{"source":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"technique_id":"T1090.002","description":"Tonto Team has routed their traffic through an external server in order to obfuscate their location.","sources":[{"source":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"technique_id":"T1105","description":"Tonto Team has downloaded malicious DLLs which served as a ShadowPad loader.","sources":[{"source":"ESET Exchange Mar 2021","url":"https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/"}]},{"technique_id":"T1135","description":"Tonto Team has used tools such as NBTscan to enumerate network shares.","sources":[{"source":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"technique_id":"T1203","description":"Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.","sources":[{"source":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"},{"source":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"},{"source":"Talos Bisonal 10 Years March 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"},{"source":"Kaspersky CactusPete Aug 2020","url":"https://securelist.com/cactuspete-apt-groups-updated-bisonal-backdoor/97962/"}]},{"technique_id":"T1204.002","description":"Tonto Team has relied on user interaction to open their malicious RTF documents.","sources":[{"source":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"},{"source":"Talos Bisonal Mar 2020","url":"https://blog.talosintelligence.com/2020/03/bisonal-10-years-of-play.html"}]},{"technique_id":"T1210","description":"Tonto Team has used EternalBlue exploits for lateral movement.","sources":[{"source":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"technique_id":"T1505.003","description":"Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.","sources":[{"source":"ESET Exchange Mar 2021","url":"https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/"}]},{"technique_id":"T1566.001","description":"Tonto Team has delivered payloads via spearphishing attachments.","sources":[{"source":"TrendMicro Tonto Team October 2020","url":"https://vb2020.vblocalhost.com/uploads/VB2020-06.pdf"}]},{"technique_id":"T1574.001","description":"Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.","sources":[{"source":"ESET Exchange Mar 2021","url":"https://www.welivesecurity.com/2021/03/10/exchange-servers-under-siege-10-apt-groups/"}]}]},{"id":"G0134","name":"Transparent Tribe","procedures":[{"technique_id":"T1027.013","description":"Transparent Tribe has dropped encoded executables on compromised hosts.","sources":[{"source":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}]},{"technique_id":"T1036.005","description":"Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.","sources":[{"source":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"}]},{"technique_id":"T1059.005","description":"Transparent Tribe has crafted VBS-based malicious documents.","sources":[{"source":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"}]},{"technique_id":"T1189","description":"Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.","sources":[{"source":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source":"Unit 42 ProjectM March 2016","url":"https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"},{"source":"Talos Transparent Tribe May 2021","url":"https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"}]},{"technique_id":"T1203","description":"Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.","sources":[{"source":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}]},{"technique_id":"T1204.001","description":"Transparent Tribe has directed users to open URLs hosting malicious content.","sources":[{"source":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"},{"source":"Talos Transparent Tribe May 2021","url":"https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"}]},{"technique_id":"T1204.002","description":"Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.","sources":[{"source":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"},{"source":"Talos Transparent Tribe May 2021","url":"https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"},{"source":"Unit 42 ProjectM March 2016","url":"https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"}]},{"technique_id":"T1564.001","description":"Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.","sources":[{"source":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"}]},{"technique_id":"T1566.001","description":"Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.","sources":[{"source":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source":"Kaspersky Transparent Tribe August 2020","url":"https://securelist.com/transparent-tribe-part-1/98127/"},{"source":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"},{"source":"Talos Transparent Tribe May 2021","url":"https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"},{"source":"Unit 42 ProjectM March 2016","url":"https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"}]},{"technique_id":"T1566.002","description":"Transparent Tribe has embedded links to malicious downloads in e-mails.","sources":[{"source":"Talos Oblique RAT March 2021","url":"https://blog.talosintelligence.com/2021/02/obliquerat-new-campaign.html"},{"source":"Talos Transparent Tribe May 2021","url":"https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"}]},{"technique_id":"T1568","description":"Transparent Tribe has used dynamic DNS services to set up C2.","sources":[{"source":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}]},{"technique_id":"T1583.001","description":"Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.","sources":[{"source":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source":"Talos Transparent Tribe May 2021","url":"https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"}]},{"technique_id":"T1584.001","description":"Transparent Tribe has compromised domains for use in targeted malicious campaigns.","sources":[{"source":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"}]},{"technique_id":"T1608.004","description":"Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with Crimson, njRAT, and other malicious tools.","sources":[{"source":"Proofpoint Operation Transparent Tribe March 2016","url":"https://www.proofpoint.com/sites/default/files/proofpoint-operation-transparent-tribe-threat-insight-en.pdf"},{"source":"Unit 42 ProjectM March 2016","url":"https://unit42.paloaltonetworks.com/unit42-projectm-link-found-between-pakistani-actor-and-operation-transparent-tribe/"},{"source":"Talos Transparent Tribe May 2021","url":"https://blog.talosintelligence.com/2021/05/transparent-tribe-infra-and-targeting.html"}]}]},{"id":"G0081","name":"Tropic Trooper","procedures":[{"technique_id":"T1016","description":"Tropic Trooper has used scripts to collect the host's network topology.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1020","description":"Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1027.003","description":"Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1027.013","description":"Tropic Trooper has encrypted configuration files.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"},{"source":"TrendMicro Tropic Trooper Mar 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"}]},{"technique_id":"T1033","description":"Tropic Trooper used letmein to scan for saved usernames on the target system.","sources":[{"source":"TrendMicro TropicTrooper 2015","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"}]},{"technique_id":"T1036.005","description":"Tropic Trooper has hidden payloads in Flash directories and fake installer files.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1046","description":"Tropic Trooper used pr and an openly available tool to scan for open ports on target systems.","sources":[{"source":"TrendMicro TropicTrooper 2015","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1049","description":"Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1052.001","description":"Tropic Trooper has exfiltrated data using USB storage devices.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1055.001","description":"Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.","sources":[{"source":"TrendMicro Tropic Trooper Mar 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1057","description":"Tropic Trooper is capable of enumerating the running processes on the system using pslist.","sources":[{"source":"Unit 42 Tropic Trooper Nov 2016","url":"https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1059.003","description":"Tropic Trooper has used Windows command scripts.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1070.004","description":"Tropic Trooper has deleted dropper files on an infected system using command scripts.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1071.001","description":"Tropic Trooper has used HTTP in communication with the C2.","sources":[{"source":"Anomali Pirate Panda April 2020","url":"https://www.anomali.com/blog/anomali-suspects-that-china-backed-apt-pirate-panda-may-be-seeking-access-to-vietnam-government-data-center#When:15:00:00Z"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1071.004","description":"Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1078.003","description":"Tropic Trooper has used known administrator account credentials to execute the backdoor directly.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1082","description":"Tropic Trooper has detected a target system’s OS version.","sources":[{"source":"TrendMicro TropicTrooper 2015","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1083","description":"Tropic Trooper has monitored files' modified time.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1091","description":"Tropic Trooper has attempted to transfer USBferry from an infected USB device by copying an Autorun function to the target machine.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1105","description":"Tropic Trooper has used a delivered trojan to download additional files.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1106","description":"Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1119","description":"Tropic Trooper has collected information automatically using the adversary's USBferry attack.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1132.001","description":"Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1135","description":"Tropic Trooper used netview to scan target systems for shared resources.","sources":[{"source":"TrendMicro TropicTrooper 2015","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"}]},{"technique_id":"T1140","description":"Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload. Tropic Trooper also decrypted image files which contained a payload.","sources":[{"source":"Unit 42 Tropic Trooper Nov 2016","url":"https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1203","description":"Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.","sources":[{"source":"TrendMicro Tropic Trooper Mar 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"},{"source":"Unit 42 Tropic Trooper Nov 2016","url":"https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"}]},{"technique_id":"T1204.002","description":"Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.","sources":[{"source":"Anomali Pirate Panda April 2020","url":"https://www.anomali.com/blog/anomali-suspects-that-china-backed-apt-pirate-panda-may-be-seeking-access-to-vietnam-government-data-center#When:15:00:00Z"}]},{"technique_id":"T1221","description":"Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.","sources":[{"source":"Unit 42 Tropic Trooper Nov 2016","url":"https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"}]},{"technique_id":"T1505.003","description":"Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1518","description":"Tropic Trooper's backdoor could list the infected system's installed software.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1518.001","description":"Tropic Trooper can search for anti-virus software running on the system.","sources":[{"source":"Unit 42 Tropic Trooper Nov 2016","url":"https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"}]},{"technique_id":"T1543.003","description":"Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.","sources":[{"source":"PWC KeyBoys Feb 2017","url":"https://web.archive.org/web/20211129064701/https://www.pwc.co.uk/issues/cyber-security-services/research/the-keyboys-are-back-in-town.html"}]},{"technique_id":"T1547.001","description":"Tropic Trooper has created shortcuts in the Startup folder to establish persistence.","sources":[{"source":"Anomali Pirate Panda April 2020","url":"https://www.anomali.com/blog/anomali-suspects-that-china-backed-apt-pirate-panda-may-be-seeking-access-to-vietnam-government-data-center#When:15:00:00Z"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1547.004","description":"Tropic Trooper has created the Registry key HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\Shell and sets the value to establish persistence.","sources":[{"source":"Unit 42 Tropic Trooper Nov 2016","url":"https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1564.001","description":"Tropic Trooper has created a hidden directory under C:\\ProgramData\\Apple\\Updates\\ and C:\\Users\\Public\\Documents\\Flash\\.","sources":[{"source":"TrendMicro Tropic Trooper Mar 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1566.001","description":"Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.","sources":[{"source":"CitizenLab Tropic Trooper Aug 2018","url":"https://citizenlab.ca/2018/08/familiar-feeling-a-malware-campaign-targeting-the-tibetan-diaspora-resurfaces/"},{"source":"TrendMicro TropicTrooper 2015","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"},{"source":"Anomali Pirate Panda April 2020","url":"https://www.anomali.com/blog/anomali-suspects-that-china-backed-apt-pirate-panda-may-be-seeking-access-to-vietnam-government-data-center#When:15:00:00Z"},{"source":"Unit 42 Tropic Trooper Nov 2016","url":"https://researchcenter.paloaltonetworks.com/2016/11/unit42-tropic-trooper-targets-taiwanese-government-and-fossil-fuel-provider-with-poison-ivy/"}]},{"technique_id":"T1573","description":"Tropic Trooper has encrypted traffic with the C2 to prevent network detection.","sources":[{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1573.002","description":"Tropic Trooper has used SSL to connect to C2 servers.","sources":[{"source":"TrendMicro Tropic Trooper Mar 2018","url":"https://blog.trendmicro.com/trendlabs-security-intelligence/tropic-trooper-new-strategy/"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]},{"technique_id":"T1574.001","description":"Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.","sources":[{"source":"CitizenLab KeyBoy Nov 2016","url":"https://citizenlab.ca/2016/11/parliament-keyboy/"},{"source":"Anomali Pirate Panda April 2020","url":"https://www.anomali.com/blog/anomali-suspects-that-china-backed-apt-pirate-panda-may-be-seeking-access-to-vietnam-government-data-center#When:15:00:00Z"}]},{"technique_id":"T1680","description":"Tropic Trooper has detected a target system’s system volume information.","sources":[{"source":"TrendMicro TropicTrooper 2015","url":"https://documents.trendmicro.com/assets/wp/wp-operation-tropic-trooper.pdf"},{"source":"TrendMicro Tropic Trooper May 2020","url":"https://documents.trendmicro.com/assets/Tech-Brief-Tropic-Trooper-s-Back-USBferry-Attack-Targets-Air-gapped-Environments.pdf"}]}]},{"id":"G0010","name":"Turla","procedures":[{"technique_id":"T1005","description":"Turla RPC backdoors can upload files from victim machines.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1007","description":"Turla surveys a system upon check-in to discover running services and associated processes using the tasklist /svc command.","sources":[{"source":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"technique_id":"T1012","description":"Turla surveys a system upon check-in to discover information in the Windows Registry with the reg query command. Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .","sources":[{"source":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1016","description":"Turla surveys a system upon check-in to discover network configuration details using the arp -a, nbtstat -n, net config, ipconfig /all, and route commands, as well as NBTscan. Turla RPC backdoors have also retrieved registered RPC interface information from process memory.","sources":[{"source":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"},{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"},{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1016.001","description":"Turla has used tracert to check internet connectivity.","sources":[{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1018","description":"Turla surveys a system upon check-in to discover remote systems on a local network using the net view and net view /DOMAIN commands. Turla has also used net group \"Domain Computers\" /domain, net group \"Domain Controllers\" /domain, and net group \"Exchange Servers\" /domain to enumerate domain computers, including the organization's DC and Exchange Server.","sources":[{"source":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1021.002","description":"Turla used net use commands to connect to lateral systems within a network.","sources":[{"source":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"technique_id":"T1025","description":"Turla RPC backdoors can collect files from USB thumb drives.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"},{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}]},{"technique_id":"T1027.005","description":"Based on comparison of Gazer versions, Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.","sources":[{"source":"ESET Gazer Aug 2017","url":"https://www.welivesecurity.com/wp-content/uploads/2017/08/eset-gazer.pdf"}]},{"technique_id":"T1027.010","description":"Turla has used encryption (including salted 3DES via PowerSploit's Out-EncryptedScript.ps1), random variable names, and base64 encoding to obfuscate PowerShell commands and payloads.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1027.011","description":"Turla has used the Registry to store encrypted and encoded payloads.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"},{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}]},{"technique_id":"T1036.005","description":"Turla has named components of LunarWeb to mimic Zabbix agent logs.","sources":[{"source":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"technique_id":"T1049","description":"Turla surveys a system upon check-in to discover active local network connections using the netstat -an, net use, net file, and net session commands. Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the GetTcpTable2 API call.","sources":[{"source":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"},{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1055","description":"Turla has also used PowerSploit's Invoke-ReflectivePEInjection.ps1 to reflectively load a PowerShell payload into a random process on the victim system.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1055.001","description":"Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.","sources":[{"source":"ESET Turla Mosquito May 2018","url":"https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/"},{"source":"Github Rapid7 Meterpreter Elevate","url":"https://github.com/rapid7/meterpreter/tree/master/source/extensions/priv/server/elevate"}]},{"technique_id":"T1057","description":"Turla surveys a system upon check-in to discover running processes using the tasklist /v command. Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.","sources":[{"source":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1059.001","description":"Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from Empire's PSInject. Turla has also used PowerShell scripts to load and execute malware in memory.","sources":[{"source":"ESET Turla Mosquito May 2018","url":"https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/"},{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"},{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}]},{"technique_id":"T1059.003","description":"Turla RPC backdoors have used cmd.exe to execute commands.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"},{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}]},{"technique_id":"T1059.005","description":"Turla has used VBS scripts throughout its operations.","sources":[{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}]},{"technique_id":"T1059.006","description":"Turla has used IronPython scripts as part of the IronNetInjector toolchain to drop payloads.","sources":[{"source":"Unit 42 IronNetInjector February 2021 ","url":"https://unit42.paloaltonetworks.com/ironnetinjector/"}]},{"technique_id":"T1059.007","description":"Turla has used various JavaScript-based backdoors.","sources":[{"source":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}]},{"technique_id":"T1068","description":"Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.","sources":[{"source":"Unit42 AcidBox June 2020","url":"https://unit42.paloaltonetworks.com/acidbox-rare-malware/"}]},{"technique_id":"T1069.001","description":"Turla has used net localgroup and net localgroup Administrators to enumerate group information, including members of the local administrators group.","sources":[{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1069.002","description":"Turla has used net group \"Domain Admins\" /domain to identify domain administrators.","sources":[{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1071.001","description":"Turla has used HTTP and HTTPS for C2 communications.","sources":[{"source":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"},{"source":"ESET Turla Mosquito May 2018","url":"https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/"}]},{"technique_id":"T1071.003","description":"Turla has used multiple backdoors which communicate with a C2 server via email attachments.","sources":[{"source":"Crowdstrike GTR2020 Mar 2020","url":"https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf"}]},{"technique_id":"T1078.003","description":"Turla has abused local accounts that have the same password across the victim’s network.","sources":[{"source":"ESET Crutch December 2020","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}]},{"technique_id":"T1082","description":"Turla surveys a system upon check-in to discover operating system configuration details using the systeminfo and set commands.","sources":[{"source":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1083","description":"Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. Turla RPC backdoors have also searched for files matching the lPH*.dll pattern.","sources":[{"source":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"},{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"},{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1087.001","description":"Turla has used net user to enumerate local accounts on the system.","sources":[{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"},{"source":"ESET Crutch December 2020","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}]},{"technique_id":"T1087.002","description":"Turla has used net user /domain to enumerate domain accounts.","sources":[{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1090","description":"Turla RPC backdoors have included local UPnP RPC proxies.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1090.001","description":"Turla has compromised internal network systems to act as a proxy to forward traffic to C2.","sources":[{"source":"Talos TinyTurla September 2021","url":"https://blog.talosintelligence.com/2021/09/tinyturla.html"}]},{"technique_id":"T1102","description":"Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.","sources":[{"source":"Accenture HyperStack October 2020","url":"https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"},{"source":"ESET Crutch December 2020","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}]},{"technique_id":"T1102.002","description":"A Turla JavaScript backdoor has used Google Apps Script as its C2 server.","sources":[{"source":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"},{"source":"ESET Turla Mosquito May 2018","url":"https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/"}]},{"technique_id":"T1105","description":"Turla has used shellcode to download Meterpreter after compromising a victim.","sources":[{"source":"ESET Turla Mosquito May 2018","url":"https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/"}]},{"technique_id":"T1106","description":"Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1110","description":"Turla may attempt to connect to systems within a victim's network using net use commands and a predefined list or collection of passwords.","sources":[{"source":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"technique_id":"T1112","description":"Turla has modified Registry values to store payloads.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"},{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}]},{"technique_id":"T1120","description":"Turla has used fsutil fsinfo drives to list connected drives.","sources":[{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1124","description":"Turla surveys a system upon check-in to discover the system time by using the net time command.","sources":[{"source":"Kaspersky Turla","url":"https://securelist.com/the-epic-turla-operation/65545/"}]},{"technique_id":"T1134.002","description":"Turla RPC backdoors can impersonate or steal process tokens before executing commands.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1140","description":"Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or PowerShell Profile, to decode encrypted PowerShell payloads.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1189","description":"Turla has infected victims using watering holes.","sources":[{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1201","description":"Turla has used net accounts and net accounts /domain to acquire password policy information.","sources":[{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1204.001","description":"Turla has used spearphishing via a link to get users to download and run their malware.","sources":[{"source":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}]},{"technique_id":"T1213.006","description":"Turla has used a custom .NET tool to collect documents from an organization's internal central database.","sources":[{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1518.001","description":"Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.","sources":[{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1546.003","description":"Turla has used WMI event filters and consumers to establish persistence.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1546.013","description":"Turla has used PowerShell profiles to maintain persistence on an infected machine.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]},{"technique_id":"T1547.001","description":"A Turla Javascript backdoor added a local_update_check value under the Registry key HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run to establish persistence. Additionally, a Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.","sources":[{"source":"ESET Turla Mosquito May 2018","url":"https://www.welivesecurity.com/2018/05/22/turla-mosquito-shift-towards-generic-tools/"},{"source":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"},{"source":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"technique_id":"T1547.004","description":"Turla established persistence by adding a Shell value under the Registry key HKCU\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon.","sources":[{"source":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}]},{"technique_id":"T1553.006","description":"Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.","sources":[{"source":"Unit42 AcidBox June 2020","url":"https://unit42.paloaltonetworks.com/acidbox-rare-malware/"},{"source":"GitHub Turla Driver Loader","url":"https://github.com/hfiref0x/TDL"}]},{"technique_id":"T1555.004","description":"Turla has gathered credentials from the Windows Credential Manager tool.","sources":[{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}]},{"technique_id":"T1560.001","description":"Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.","sources":[{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}]},{"technique_id":"T1564.012","description":"Turla has placed LunarWeb install files into directories that are excluded from scanning.","sources":[{"source":"ESET Turla Lunar toolset May 2024","url":"https://www.welivesecurity.com/en/eset-research/moon-backdoors-lunar-landing-diplomatic-missions/"}]},{"technique_id":"T1566.002","description":"Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.","sources":[{"source":"ESET Turla Mosquito Jan 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/01/ESET_Turla_Mosquito.pdf"}]},{"technique_id":"T1567.002","description":"Turla has used WebDAV to upload stolen USB files to a cloud drive. Turla has also exfiltrated stolen files to OneDrive and 4shared.","sources":[{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"},{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1570","description":"Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"},{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}]},{"technique_id":"T1583.006","description":"Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.","sources":[{"source":"ESET Crutch December 2020","url":"https://www.welivesecurity.com/2020/12/02/turla-crutch-keeping-back-door-open/"}]},{"technique_id":"T1584.003","description":"Turla has used the VPS infrastructure of compromised Iranian threat actors.","sources":[{"source":"NSA NCSC Turla OilRig","url":"https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf"}]},{"technique_id":"T1584.004","description":"Turla has used compromised servers as infrastructure.","sources":[{"source":"Accenture HyperStack October 2020","url":"https://web.archive.org/web/20201101015247/https://www.accenture.com/us-en/blogs/cyber-defense/turla-belugasturgeon-compromises-government-entity"},{"source":"Talos TinyTurla September 2021","url":"https://blog.talosintelligence.com/2021/09/tinyturla.html"},{"source":"Recorded Future Turla Infra 2020","url":"https://www.recordedfuture.com/research/turla-apt-infrastructure"}]},{"technique_id":"T1584.006","description":"Turla has frequently used compromised WordPress sites for C2 infrastructure.","sources":[{"source":"Recorded Future Turla Infra 2020","url":"https://www.recordedfuture.com/research/turla-apt-infrastructure"}]},{"technique_id":"T1587.001","description":"Turla has developed its own unique malware for use in operations.","sources":[{"source":"Recorded Future Turla Infra 2020","url":"https://www.recordedfuture.com/research/turla-apt-infrastructure"}]},{"technique_id":"T1588.001","description":"Turla has used malware obtained after compromising other threat actors, such as OilRig.","sources":[{"source":"Recorded Future Turla Infra 2020","url":"https://www.recordedfuture.com/research/turla-apt-infrastructure"},{"source":"NSA NCSC Turla OilRig","url":"https://media.defense.gov/2019/Oct/18/2002197242/-1/-1/0/NSA_CSA_Turla_20191021%20ver%204%20-%20nsa.gov.pdf"}]},{"technique_id":"T1588.002","description":"Turla has obtained and customized publicly-available tools like Mimikatz.","sources":[{"source":"Symantec Waterbug Jun 2019","url":"https://www.symantec.com/blogs/threat-intelligence/waterbug-espionage-governments"}]},{"technique_id":"T1615","description":"Turla surveys a system upon check-in to discover Group Policy details using the gpresult command.","sources":[{"source":"ESET ComRAT May 2020","url":"https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"}]},{"technique_id":"T1685","description":"Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.","sources":[{"source":"ESET Turla PowerShell May 2019","url":"https://www.welivesecurity.com/2019/05/29/turla-powershell-usage/"}]}]},{"id":"G1048","name":"UNC3886","procedures":[{"technique_id":"T1003.001","description":"UNC3886 has used MiniDump to dump process memory and search for cleartext credentials.","sources":[{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"technique_id":"T1008","description":"UNC3886 has employed layers of redundancy to maintain access to compromised environments including network devices, hypervisors, and virtual machines.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"technique_id":"T1014","description":"UNC3886 has used the publicly available rootkits REPTILE and MEDUSA on targeted VMs.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"technique_id":"T1021.004","description":"UNC3886 has established remote SSH access to targeted ESXi hosts.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1027.005","description":"UNC3886 has replaced atomic indicators mentioned in threat intelligence publications, sometimes as quickly as under a week after release.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"technique_id":"T1036.004","description":"UNC3886 has named a file ‘fgfm’ in an attempt to disguise it as the legitimate service ‘fgfmd’ which facilitates communication between FortiManager and the FortiGate firewall.","sources":[{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1037","description":"UNC3886 has attempted to bypass digital signature verification checks at startup by adding a command to the startup config /etc/init.d/localnet within the rootfs.gz archive of both FortiManager and FortiAnalyzer devices.","sources":[{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1037.004","description":"UNC3886 has placed a bash installation script into /etc/rc.local.d/ to establish persistence.","sources":[{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"technique_id":"T1040","description":"UNC3886 has used the LOOKOVER sniffer to sniff TACACS+ authentication packets.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"technique_id":"T1057","description":"UNC3886 has run scripts to list all running processes on a guest VM from an ESXi host.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"technique_id":"T1059.001","description":"UNC3886 has used a PowerShell script to search memory dumps for credentials.","sources":[{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"technique_id":"T1059.003","description":"UNC3886 has executed Windows commands on guest virtual machines through vmtoolsd.exe.","sources":[{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"technique_id":"T1059.004","description":"UNC3886 has used a bash script to install malicious vSphere Installation Bundles (VIBs).","sources":[{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"technique_id":"T1059.006","description":"UNC3886 has used Python scripts to enumerate ESXi hosts and guest VMs.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"technique_id":"T1059.012","description":"UNC3886 has used the esxcli command line utility to modify firewall rules, install malware, and for artifact removal.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"technique_id":"T1068","description":"UNC3886 has exploited zero-day vulnerability CVE-2023-20867 to enable execution of privileged commands across Windows, Linux, and PhotonOS (vCenter) guest VMs.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"technique_id":"T1070.004","description":"UNC3886 has used the the esxcli command line to remove files created by malicious vSphere Installation Bundles from disk.","sources":[{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"},{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1070.006","description":"UNC3886 has used scripts to timestomp ESXi hosts prior to installing malicious vSphere Installation Bundles (VIBs).","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"technique_id":"T1070.007","description":"UNC3886 has cleared specific events that contained the threat actor’s IP address from multiple log sources.","sources":[{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1074.001","description":"UNC3886 has staged captured credentials in var/log/ldapd.2.gz.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"technique_id":"T1078","description":"UNC3886 has used tools to hijack valid SSH accounts.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"technique_id":"T1078.001","description":"UNC3886 has harvested and used vCenter Server service accounts.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"technique_id":"T1083","description":"UNC3886 has used vmtoolsd.exe to enumerate files on guest machines.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"technique_id":"T1095","description":"UNC3886 has deployed backdoors that communicate over TCP to compromised network devices and over VMCI to ESXi hosts.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1124","description":"UNC3886 has used installation scripts to collect the system time on targeted ESXi hosts.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"technique_id":"T1190","description":"UNC3886 has exploited CVE-2022-42475 in FortiOS SSL VPNs to obtain access.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1203","description":"UNC3886 has exoloited CVE-2023-34048 to enable command execution on vCenter servers and CVE-2023-20867 in VMware Tools to execute unauthenticated Guest Operations from ESXi hosts to guest VMs.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"technique_id":"T1205","description":"UNC3886 has used the TABLEFLIP traffic redirection utility to listen for specialized command packets on compromised FortiManager devices.","sources":[{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1205.001","description":"UNC3886 maintained persistence on FortiGate Firewalls through ICMP port knocking.","sources":[{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1212","description":"UNC3886 exploited CVE-2022-22948 in VMware vCenter to obtain encrypted credentials from the vCenter postgresDB.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"technique_id":"T1218.011","description":"UNC3886 has used rundll32.exe to execute MiniDump for dumping LSASS process memory.","sources":[{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"technique_id":"T1505.006","description":"UNC3886 has used vSphere Installation Bundles (VIBs) to install malware and establish persistence across ESXi hypervisors.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"},{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1548","description":"UNC3886 has used vSphere Installation Bundles (VIBs) that contained modified descriptor XML files with the acceptance-level set to partner which allowed for privilege escalation.","sources":[{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"technique_id":"T1554","description":"UNC3886 has trojanized Fortinet firmware and replaced the legitimate /usr/bin/tac_plus TACACS+ daemon for Linux with a malicious version containing credential logging functionality.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1555.005","description":"UNC3886 has targeted KeyPass password database files for credential access.","sources":[{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"technique_id":"T1560.001","description":"UNC3886 has used Gzip and the Windows command makecab to compress files and stolen credentials from victim systems.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"}]},{"technique_id":"T1560.003","description":"UNC3886 has XOR encrypted and Gzip compressed captured credentials.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"technique_id":"T1564.011","description":"UNC3886 modified the startup file /etc/init.d/localnet to execute the line nohup /bin/support & so the script would run when the system was rebooted.","sources":[{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1570","description":"UNC3886 has utilzed Python scripts to transfer files between ESXi hosts and guest VMs.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"technique_id":"T1587.001","description":"UNC3886 has deployed custom malware families on Fortinet and VMware systems.","sources":[{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1587.004","description":"UNC3886 has used zero-day vulnerabilities CVE-2022-41328 against FortiOS and CVE-2023-20867 and CVE-2023-34048 against VMware vCenter.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1588.001","description":"UNC3886 has used the publicly available rootkits REPTILE and MEDUSA.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"technique_id":"T1588.004","description":"UNC3886 has deployed malware using the victim's legitimate TLS certificate obtained from a compromised FortiGate device.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"}]},{"technique_id":"T1673","description":"UNC3886 has used scripts to enumerate ESXi hypervisors and their guest VMs.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"technique_id":"T1675","description":"UNC3886 used vmtoolsd.exe to run commands on guest virtual machines from a compromised ESXi host.","sources":[{"source":"Google Cloud Mandiant UNC3886 2024","url":"https://cloud.google.com/blog/topics/threat-intelligence/uncovering-unc3886-espionage-operations"},{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"},{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1681","description":"UNC3886 has replaced indicators mentioned in open-source threat intelligence publications at times under a week after their release.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]},{"technique_id":"T1685","description":"UNC3886 has disabled OpenSSL digital signature verification of system files through corruption of boot files.","sources":[{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1686","description":"UNC3886 has used the TABLEFLIP traffic redirection utility and the esxcli command line to modify firewall rules.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"},{"source":"Google Cloud Threat Intelligence ESXi VIBs 2022","url":"https://cloud.google.com/blog/topics/threat-intelligence/esxi-hypervisors-malware-persistence"},{"source":"Mandiant Fortinet Zero Day","url":"https://www.mandiant.com/resources/blog/fortinet-malware-ecosystem"}]},{"technique_id":"T1690","description":"UNC3886 has tampered with and disabled logging services on targeted systems.","sources":[{"source":"Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023","url":"https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"}]}]},{"id":"G1047","name":"Velvet Ant","procedures":[{"technique_id":"T1021.002","description":"Velvet Ant has transferred tools within victim environments using SMB.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1036.005","description":"Velvet Ant used a malicious DLL, iviewers.dll, that mimics the legitimate \"OLE/COM Object Viewer\" within Windows.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1037.004","description":"Velvet Ant used a modified /etc/rc.local file on compromised F5 BIG-IP devices to maintain persistence.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1040","description":"Velvet Ant has used a custom tool, \"VELVETTAP\", to perform packet capture from compromised F5 BIG-IP devices.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1047","description":"Velvet Ant used the wmiexec.py tool within Impacket for remote process execution via WMI.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1049","description":"Velvet Ant has enumerated existing network connections on victim devices.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1055","description":"Velvet Ant initial execution included launching multiple svchost processes and injecting code into them.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1059.004","description":"Velvet Ant used a custom tool, VELVETSTING, to parse encoded inbound commands to compromised F5 BIG-IP devices and then execute them via the Unix shell.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1071","description":"Velvet Ant has used reverse SSH tunnels to communicate to victim devices.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1078.003","description":"Velvet Ant accessed vulnerable Cisco switch devices using accounts with administrator privileges.","sources":[{"source":"Sygnia VelvetAnt 2024B","url":"https://www.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group-velvet-ant-exploits-cisco-0-day/"}]},{"technique_id":"T1083","description":"Velvet Ant has enumerated local files and folders on victim devices.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1090.001","description":"Velvet Ant has tunneled traffic from victims through an internal, compromised host to proxy communications to command and control nodes.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1132","description":"Velvet Ant sent commands to compromised F5 BIG-IP devices in an encoded format requiring a passkey before interpretation and execution.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1133","description":"Velvet Ant has leveraged access to internet-facing remote services to compromise and retain access to victim environments.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1211","description":"Velvet Ant exploited CVE-2024-20399 in Cisco Switches to which the threat actor was already able to authenticate in order to escape the NX-OS command line interface and gain access to the underlying operating system for arbitrary command execution.","sources":[{"source":"Sygnia VelvetAnt 2024B","url":"https://www.sygnia.co/threat-reports-and-advisories/china-nexus-threat-group-velvet-ant-exploits-cisco-0-day/"}]},{"technique_id":"T1569.002","description":"Velvet Ant executed and installed PlugX as a Windows service.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1570","description":"Velvet Ant transferred files laterally within victim networks through the Impacket toolkit.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1571","description":"Velvet Ant has used random high number ports for PlugX listeners on victim devices.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1573.002","description":"Velvet Ant has used a reverse SSH shell to securely communicate with victim devices.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1574.001","description":"Velvet Ant has used malicious DLLs executed via legitimate EXE files through DLL search order hijacking to launch follow-on payloads such as PlugX.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1685","description":"Velvet Ant attempted to disable local security tools and endpoint detection and response (EDR) software during operations.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]},{"technique_id":"T1686","description":"Velvet Ant modified system firewall settings during PlugX installation using netsh.exe to open a listening, random high number port on victim devices.","sources":[{"source":"Sygnia VelvetAnt 2024A","url":"https://www.sygnia.co/blog/china-nexus-threat-group-velvet-ant/"}]}]},{"id":"G1055","name":"VOID MANTICORE","procedures":[{"technique_id":"T1003.001","description":"VOID MANTICORE has dumped LSASS credentials using comsvcs.dll via rundll32.exe.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1005","description":"VOID MANTICORE has collected cached data and files from within the victim environment.","sources":[{"source":"SPECOPS Outpost24 Handala Hack Stryker March 2026","url":"https://specopssoft.com/blog/stryker-cyber-attack-what-we-know-remote-wipe/"},{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1021.001","description":"VOID MANTICORE has used RDP to move laterally within the victim environment.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1027.015","description":"VOID MANTICORE has compressed their payloads by leveraging zip files.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1036.004","description":"VOID MANTICORE has masqueraded as commonly used programs and services on Windows hosts.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1036.005","description":"VOID MANTICORE has masqueraded malicious payloads to resemble legitimate applications. VOID MANTICORE has leveraged malicious payloads that use nomenclature associated with common applications that include Pictory, KeePass, WhatsApp, and Telegram.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1041","description":"VOID MANTICORE malware has exfiltrated collected data via Telegram bot C2 channels using encrypted communications.","sources":[{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"}]},{"technique_id":"T1047","description":"VOID MANTICORE has utilized WMIC to log into the victim host and create a process process call create “cmd.exe /c copy \\\\?\\\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\windows\\system32\\config\\system c:\\users\\public”.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1059.001","description":"VOID MANTICORE has utilized PowerShell to execute malware in victim environments.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1059.006","description":"VOID MANTICORE has utilized Python scripts to execute its malicious payloads.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1071.001","description":"VOID MANTICORE has utilized HTTPS for communication to C2 domains.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1072","description":"VOID MANTICORE has leveraged legitimate built-in features of cloud-based management platforms to include mobile device management (MDM) and Remote Monitoring and Management (RMM) solutions. VOID MANTICORE has also initiated built-in remote wipe instructions using a privileged account within Microsoft Intune.","sources":[{"source":"SPECOPS Outpost24 Handala Hack Stryker March 2026","url":"https://specopssoft.com/blog/stryker-cyber-attack-what-we-know-remote-wipe/"},{"source":"Palo Alto VOID MANTICORE Iran Cyber Threats March 2026","url":"https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/"}]},{"technique_id":"T1074","description":"VOID MANTICORE has staged compressed files in specified locations prior to exfiltration over C2.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1078","description":"VOID MANTICORE has leveraged valid accounts to log into VPN infrastructure. VOID MANTICORE has used compromised valid credentials to gain access to management infrastructure and enterprise control systems. VOID MANTICORE has also validated and tested authentication using compromised credentials prior to malicious actions.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"},{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"}]},{"technique_id":"T1078.002","description":"VOID MANTICORE has used previously compromised Domain Administrator credentials to maintain persistent access.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1078.004","description":"VOID MANTICORE has leveraged privileged cloud accounts to access cloud-based management consoles to include Microsoft Intune. VOID MANTICORE has also compromised existing accounts within the Microsoft Entra ID environment.","sources":[{"source":"Palo Alto VOID MANTICORE Iran Cyber Threats March 2026","url":"https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/"},{"source":"SEC 8-K Stryker Corporation Filing Handala Hack March 2026","url":"https://www.sec.gov/ix?doc=/Archives/edgar/data/0000310764/000119312526118634/d94012d8k.htm"}]},{"technique_id":"T1082","description":"VOID MANTICORE has gathered system information and disseminated it back to C2.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1087.002","description":"VOID MANTICORE has utilized ADRecon to enumerate the active directory environment.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1098","description":"VOID MANTICORE has leveraged access to administrative control systems to achieve disruptive effects, consistent with administrative account abuse or privilege escalation within existing access.","sources":[{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"},{"source":"SEC 8K Palo Alto Statement Stryker Corp Handala March 2026","url":"https://www.sec.gov/Archives/edgar/data/310764/000119312526118634/d94012dex991.htm"}]},{"technique_id":"T1102","description":"VOID MANTICORE has utilized Telegram API for C2.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1105","description":"VOID MANTICORE has deployed additional payloads from dedicated C2 servers. VOID MANTICORE has also downloaded legitimate tools and software from publicly available services. VOID MANTICORE had utilized VeraCrypt a legitimate disk encrypting utility that was downloaded directly from the website.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"},{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1110","description":"VOID MANTICORE has conducted brute-force attempts against organizational VPN infrastructure.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1110.001","description":"VOID MANTICORE has conducted password guessing to gain initial access.","sources":[{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"}]},{"technique_id":"T1110.004","description":"VOID MANTICORE has utilized credential stuffing attacks to obtain initial access to victim environments.","sources":[{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"}]},{"technique_id":"T1113","description":"VOID MANTICORE has captured screen content during an active Zoom session.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1114.002","description":"VOID MANTICORE has gathered victim email-content from victim servers.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"technique_id":"T1119","description":"VOID MANTICORE conducted large-scale data exfiltration in the Stryker operation, consistent with automated or scripted collection against enterprise systems.","sources":[{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"}]},{"technique_id":"T1123","description":"VOID MANTICORE has gathered audio during a Zoom session.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1125","description":"VOID MANTICORE has collected video from compromised victim devices.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1133","description":"VOID MANTICORE has leveraged public facing VPN infrastructure to gain initial access to victim environments.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1190","description":"VOID MANTICORE has exploited public facing vulnerabilities within victim environments to include SharePoint CVE-2019-0604.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"technique_id":"T1199","description":"VOID MANTICORE has targeted IT and service providers in an effort to obtain credentials, relying largely on compromised VPN accounts for initial access.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1204.002","description":"VOID MANTICORE has delivered malicious payloads that initiate through user execution to include interaction with a masqueraded file. VOID MANTICORE has used trojanized application lures to induce targets into executing malware enabling persistent surveillance.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"},{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1213.002","description":"VOID MANTICORE has accessed victim’s public facing SharePoint servers and exfiltrated data.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"technique_id":"T1219.002","description":"VOID MANTICORE has installed NetBird on victim devices to create a mesh network that facilitated control of several victim devices at once.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1484.001","description":"VOID MANTICORE had utilized Group Policy logon scripts to distribute the malicious payloads to victim devices through the execution of a batch file.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1485","description":"VOID MANTICORE has conducted data wiping attacks on compromised systems. VOID MANTICORE has also manually deleted files from compromised hosts, to include selecting all files and then deleting them.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"},{"source":"SPECOPS Outpost24 Handala Hack Stryker March 2026","url":"https://specopssoft.com/blog/stryker-cyber-attack-what-we-know-remote-wipe/"},{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source":"Palo Alto VOID MANTICORE Iran Cyber Threats March 2026","url":"https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/"}]},{"technique_id":"T1486","description":"VOID MANTICORE has utilized legitimate disk encryption utilities to increase likelihood of encrypting system drives and reduce system recovery efforts.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"},{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"technique_id":"T1490","description":"VOID MANTICORE has deleted virtual machines directly from the virtualization platform.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1547.001","description":"VOID MANTICORE has created Windows Registry entries to autorun stage two malware payloads to maintain persistence.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1552.002","description":"VOID MANTICORE had exported credentials from registry hives to include those stored in HKLM.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1560.001","description":"VOID MANTICORE has stored collected data in a password protected compressed file prior to exfiltration.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1561.001","description":"VOID MANTICORE has utilized a disk wiping utility to facilitate destructive actions on victim servers. VOID MANTICORE has also utilized legitimate remote disk wiping commands.","sources":[{"source":"SPECOPS Outpost24 Handala Hack Stryker March 2026","url":"https://specopssoft.com/blog/stryker-cyber-attack-what-we-know-remote-wipe/"},{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"technique_id":"T1561.002","description":"VOID MANTICORE has deployed custom wipers that overwrite system files and the host devices master boot records (MBR) to corrupt or destroy files.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1564.003","description":"VOID MANTICORE has utilized PowerShell scripts that run without notifying the user of its execution to include -nop -w hidden- ep bypass -enc.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1566","description":"VOID MANTICORE has emailed victims threatening messages. VOID MANTICORE has used phishing as an initial access vector.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"}]},{"technique_id":"T1572","description":"VOID MANTICORE has used tunneling tools to facilitate destructive attacks on compromised devices.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1583.001","description":"VOID MANTICORE has registered domains for messaging purposes. VOID MANTICORE has created typosquatted domains and sub-domains in attempts to avoid detection or draw suspicion. VOID MANTICORE has also purchased domains leveraging cryptocurrency platforms to include LiteCoin and Ramzinex. VOID MANTICORE has registered and rotated domains to support public-facing dissemination infrastructure, replacing disrupted domains with new registrations.","sources":[{"source":"SPECOPS Outpost24 Handala Hack Stryker March 2026","url":"https://specopssoft.com/blog/stryker-cyber-attack-what-we-know-remote-wipe/"},{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"},{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1583.003","description":"VOID MANTICORE has utilized VPS solutions for C2.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1583.004","description":"VOID MANTICORE has leveraged backend servers within Iran.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"technique_id":"T1583.006","description":"VOID MANTICORE has obtained access to commercial VPN services to launch malicious activity. VOID MANTICORE has also leveraged Starlink internet services. VOID MANTICORE has used operator-controlled Telegram bots and channels as C2 infrastructure.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"},{"source":"SPECOPS Outpost24 Handala Hack Stryker March 2026","url":"https://specopssoft.com/blog/stryker-cyber-attack-what-we-know-remote-wipe/"},{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"}]},{"technique_id":"T1585.001","description":"VOID MANTICORE has created Telegram Accounts. VOID MANTICORE has also leveraged online personas such as Handala Hack, Karma, and Homeland Justice on social media to include Telegram. VOID MANTICORE has established and maintained social media accounts on Twitter/X and Telegram to amplify operational claims and stolen data disclosures.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"},{"source":"SPECOPS Outpost24 Handala Hack Stryker March 2026","url":"https://specopssoft.com/blog/stryker-cyber-attack-what-we-know-remote-wipe/"},{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"},{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"},{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1585.002","description":"VOID MANTICORE has created email accounts to send threatening messages to victims to include ‘Handala_Team[@]outlook[.]com’.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"technique_id":"T1587.001","description":"VOID MANTICORE has utilized custom-malware and wipers to include BiBi Wiper.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"technique_id":"T1588.001","description":"VOID MANTICORE has developed or obtained trojanized applications used for persistent surveillance of targeted individuals.","sources":[{"source":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"}]},{"technique_id":"T1588.002","description":"VOID MANTICORE has obtained and utilized commercial VPN services, open-source software and publicly available offensive security tools to facilitate malicious activities.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]},{"technique_id":"T1589","description":"VOID MANTICORE has gathered details on their intended victims to aid in social engineering efforts for leveraging tailored themes of attacks.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1595.002","description":"VOID MANTICORE has scanned victim environments for susceptibility to vulnerability exploitation.","sources":[{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"technique_id":"T1651","description":"VOID MANTICORE has abused built-in remote wipe or factory reset commands to wipe devices managed within an organization’s Cloud management solution impacting laptops, servers, and mobile devices.","sources":[{"source":"Palo Alto VOID MANTICORE Iran Cyber Threats March 2026","url":"https://unit42.paloaltonetworks.com/evolution-of-iran-cyber-threats/"}]},{"technique_id":"T1657","description":"VOID MANTICORE has conducted data exfiltration and posted stolen information on data leak sites for the purposes of financial and political extortion. VOID MANTICORE has also sold stolen data to prospective buyers for cryptocurrency.","sources":[{"source":"SPECOPS Outpost24 Handala Hack Stryker March 2026","url":"https://specopssoft.com/blog/stryker-cyber-attack-what-we-know-remote-wipe/"},{"source":"DOJ FBI Handala Hack March 2026","url":"https://www.justice.gov/opa/media/1431956/dl?inline"}]},{"technique_id":"T1679","description":"VOID MANTICORE has avoided interacting with specific directories in order to reduce the likelihood of detection.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1684.001","description":"VOID MANTICORE has impersonated individuals familiar to the victim and technical support associated with social messaging services.","sources":[{"source":"FBI IC3 Flash VOID MANTICORE Handala Hack March 2026","url":"https://www.ic3.gov/CSA/2026/260320.pdf"}]},{"technique_id":"T1686.003","description":"VOID MANTICORE has disabled Windows Defender protections to allow for follow-on activities within the compromised host.","sources":[{"source":"Check Point VOID MANTICORE Handala Hack March 2026","url":"https://research.checkpoint.com/2026/handala-hack-unveiling-groups-modus-operandi/"}]}]},{"id":"G0123","name":"Volatile Cedar","procedures":[{"technique_id":"T1105","description":"Volatile Cedar can deploy additional tools.","sources":[{"source":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"technique_id":"T1190","description":"Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.","sources":[{"source":"CheckPoint Volatile Cedar March 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"},{"source":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"technique_id":"T1505.003","description":"Volatile Cedar can inject web shell code into a server.","sources":[{"source":"CheckPoint Volatile Cedar March 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"},{"source":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"technique_id":"T1595.002","description":"Volatile Cedar has performed vulnerability scans of the target server.","sources":[{"source":"CheckPoint Volatile Cedar March 2015","url":"https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2015/03/20082004/volatile-cedar-technical-report.pdf"},{"source":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]},{"technique_id":"T1595.003","description":"Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.","sources":[{"source":"ClearSky Lebanese Cedar Jan 2021","url":"https://www.clearskysec.com/wp-content/uploads/2021/01/Lebanese-Cedar-APT.pdf"}]}]},{"id":"G1017","name":"Volt Typhoon","procedures":[{"technique_id":"T1003.001","description":"Volt Typhoon has attempted to access hashed credentials from the LSASS process memory space.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}]},{"technique_id":"T1003.003","description":"Volt Typhoon has used ntds.util to create domain controller installation media containing usernames and password hashes.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1005","description":"Volt Typhoon has stolen files from a sensitive file server and the Active Directory database from targeted environments, and used Wevtutil to extract event log information.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1006","description":"Volt Typhoon has executed the Windows-native vssadmin command to create volume shadow copies.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1007","description":"Volt Typhoon has used net start to list running services.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1010","description":"Volt Typhoon has collected window title information from compromised systems.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1012","description":"Volt Typhoon has queried the Registry on compromised systems, reg query hklm\\software\\, for information on installed software including PuTTY.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1016","description":"Volt Typhoon has executed multiple commands to enumerate network topology and settings including ipconfig, netsh interface firewall show all, and netsh interface portproxy show all.","sources":[{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1016.001","description":"Volt Typhoon has employed Ping to check network connectivity.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1018","description":"Volt Typhoon has used multiple methods, including Ping, to enumerate systems on compromised networks.","sources":[{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}]},{"technique_id":"T1021.001","description":"Volt Typhoon has moved laterally to the Domain Controller via RDP using a compromised account with domain administrator privileges.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1027.002","description":"Volt Typhoon has used the Ultimate Packer for Executables (UPX) to obfuscate the FRP client files BrightmetricAgent.exe and SMSvcService.ex) and the port scanning utility ScanLine.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1033","description":"Volt Typhoon has used public tools and executed the PowerShell command Get-EventLog security -instanceid 4624 to identify associated user and computer account names.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1036.005","description":"Volt Typhoon has used legitimate looking filenames for compressed copies of the ntds.dit database and used names including cisco_up.exe, cl64.exe, vm3dservice.exe, watchdogd.exe, Win.exe, WmiPreSV.exe, and WmiPrvSE.exe for the Earthworm and Fast Reverse Proxy tools.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1036.008","description":"Volt Typhoon has appended copies of the ntds.dit database with a .gif file extension.","sources":[{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"technique_id":"T1046","description":"Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for network service discovery.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1047","description":"Volt Typhoon has leveraged WMIC for execution, remote system discovery, and to create and use temporary directories.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1049","description":"Volt Typhoon has used netstat -ano on compromised hosts to enumerate network connections.","sources":[{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1056.001","description":"Volt Typhoon has created and accessed a file named rult3uil.log on compromised domain controllers to capture keypresses and command execution.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1057","description":"Volt Typhoon has enumerated running processes on targeted systems including through the use of Tasklist.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}]},{"technique_id":"T1059.001","description":"Volt Typhoon has used PowerShell including for remote system discovery.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1059.003","description":"Volt Typhoon has used the Windows command line to perform hands-on-keyboard activities in targeted environments including for discovery.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1059.004","description":"Volt Typhoon has used Brightmetricagent.exe which contains a command- line interface (CLI) library that can leverage command shells including Z Shell (zsh).","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1068","description":"Volt Typhoon has gained initial access by exploiting privilege escalation vulnerabilities in the operating system or network services.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1069","description":"Volt Typhoon has used commercial tools, LOTL utilities, and appliances already present on the system for group and user discovery.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1069.001","description":"Volt Typhoon has run net localgroup administrators in compromised environments to enumerate accounts.","sources":[{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1069.002","description":"Volt Typhoon has run net group in compromised environments to discover domain groups.","sources":[{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"technique_id":"T1070.004","description":"Volt Typhoon has run rd /S to delete their working directories and deleted systeminfo.dat from C:\\Users\\Public\\Documentsfiles.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"technique_id":"T1070.007","description":"Volt Typhoon has inspected server logs to remove their IPs.","sources":[{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"technique_id":"T1074","description":"Volt Typhoon has staged collected data in password-protected archives.","sources":[{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}]},{"technique_id":"T1074.001","description":"Volt Typhoon has saved stolen files including the ntds.dit database and the SYSTEM and SECURITY Registry hives locally to the C:\\Windows\\Temp\\ directory.","sources":[{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1078","description":"Volt Typhoon relies primarily on valid credentials for persistence.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1078.002","description":"Volt Typhoon has used compromised domain accounts to authenticate to devices on compromised networks.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}]},{"technique_id":"T1083","description":"Volt Typhoon has enumerated directories containing vulnerability testing and cyber related content and facilities data such as construction drawings.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1087.001","description":"Volt Typhoon has executed net user and quser to enumerate local account information.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1087.002","description":"Volt Typhoon has run net group /dom and net group \"Domain Admins\" /dom in compromised environments for account discovery.","sources":[{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1090","description":"Volt Typhoon has used compromised devices and customized versions of open source tools such as FRP (Fast Reverse Proxy), Earthworm, and Impacket to proxy network traffic.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1090.001","description":"Volt Typhoon has used the built-in netsh port proxy command to create proxies on compromised systems to facilitate access.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}]},{"technique_id":"T1090.003","description":"Volt Typhoon has used multi-hop proxies for command-and-control infrastructure.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1105","description":"Volt Typhoon has downloaded an outdated version of comsvcs.dll to a compromised domain controller in a non-standard folder.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1112","description":"Volt Typhoon has used netsh to create a PortProxy Registry modification on a compromised server running the Paessler Router Traffic Grapher (PRTG).","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1113","description":"Volt Typhoon has obtained a screenshot of the victim's system using the gdi32.dll and gdiplus.dll libraries.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1120","description":"Volt Typhoon has obtained victim's screen dimension and display device information.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1124","description":"Volt Typhoon has obtained the victim's system timezone.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1133","description":"Volt Typhoon has used VPNs to connect to victim environments and enable post-exploitation actions.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1140","description":"Volt Typhoon has used Base64-encoded data to transfer payloads and commands, including deobfuscation via certutil.","sources":[{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"technique_id":"T1190","description":"Volt Typhoon has gained initial access through exploitation of multiple vulnerabilities in internet-facing software and appliances such as Fortinet, Ivanti (formerly Pulse Secure), NETGEAR, Citrix, and Cisco.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"technique_id":"T1217","description":"Volt Typhoon has targeted the browsing history of network administrators.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1218","description":"Volt Typhoon has used native tools and processes including living off the land binaries or “LOLBins\" to maintain and expand access to the victim networks.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1497.001","description":"Volt Typhoon has run system checks to determine if they were operating in a virtualized environment.","sources":[{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}]},{"technique_id":"T1505.003","description":"Volt Typhoon has used webshells, including ones named AuditReport.jspx and iisstart.aspx, in compromised environments.","sources":[{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"technique_id":"T1518","description":"Volt Typhoon has queried the Registry on compromised systems for information on installed software.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1552","description":"Volt Typhoon has obtained credentials insecurely stored on targeted network appliances.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1552.004","description":"Volt Typhoon has accessed a Local State file that contains the AES key used to encrypt passwords stored in the Chrome browser.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1555","description":"Volt Typhoon has attempted to obtain credentials from OpenSSH, realvnc, and PuTTY.","sources":[{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1555.003","description":"Volt Typhoon has targeted network administrator browser data including browsing history and stored credentials.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1560.001","description":"Volt Typhoon has archived the ntds.dit database as a multi-volume password-protected archive with 7-Zip.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"technique_id":"T1570","description":"Volt Typhoon has copied web shells between servers in targeted environments.","sources":[{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"technique_id":"T1573.001","description":"Volt Typhoon has used a version of the Awen web shell that employed AES encryption and decryption for C2 communications.","sources":[{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"technique_id":"T1584.003","description":"Volt Typhoon has compromised Virtual Private Servers (VPS) to proxy C2 traffic.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1584.004","description":"Volt Typhoon has used compromised Paessler Router Traffic Grapher (PRTG) servers from other organizations for C2.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"}]},{"technique_id":"T1584.005","description":"Volt Typhoon has used compromised Cisco and NETGEAR end-of-life SOHO routers implanted with KV Botnet malware to support operations.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1584.008","description":"Volt Typhoon has compromised small office and home office (SOHO) network edge devices, many of which were located in the same geographic area as the victim, to proxy network traffic.","sources":[{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1587.004","description":"Volt Typhoon has exploited zero-day vulnerabilities for initial access.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1588.002","description":"Volt Typhoon has used legitimate network and forensic tools and customized versions of open-source tools for C2.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"}]},{"technique_id":"T1588.006","description":"Volt Typhoon has used publicly available exploit code for initial access.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1589","description":"Volt Typhoon has gathered victim identify information during pre-compromise reconnaissance.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1589.002","description":"Volt Typhoon has targeted the personal emails of key network and IT staff at victim organizations.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1590","description":"Volt Typhoon has conducted extensive pre-compromise reconnaissance to learn about the target organization’s network.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1590.004","description":"Volt Typhoon has conducted extensive reconnaissance of victim networks including identifying network topologies.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1590.006","description":"Volt Typhoon has identified target network security measures as part of pre-compromise reconnaissance.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1591","description":"Volt Typhoon has conducted extensive reconnaissance pre-compromise to gain information about the targeted organization.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1591.004","description":"Volt Typhoon has identified key network and IT staff members pre-compromise at targeted organizations.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1592","description":"Volt Typhoon has conducted pre-compromise reconnaissance for victim host information.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1593","description":"Volt Typhoon has conducted pre-compromise web searches for victim information.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1594","description":"Volt Typhoon has conducted pre-compromise reconnaissance on victim-owned sites.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1596.005","description":"Volt Typhoon has used FOFA, Shodan, and Censys to search for exposed victim infrastructure.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1614","description":"Volt Typhoon has obtained the victim's system current location.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]},{"technique_id":"T1654","description":"Volt Typhoon has used wevtutil.exe and the PowerShell command Get-EventLog security to enumerate Windows logs to search for successful logons.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1680","description":"Volt Typhoon has discovered file system types, drive names, size, and free space on compromised systems.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"},{"source":"Secureworks BRONZE SILHOUETTE May 2023","url":"https://web.archive.org/web/20230601025540/https://www.secureworks.com/blog/chinese-cyberespionage-group-bronze-silhouette-targets-us-government-and-defense-organizations"},{"source":"Microsoft Volt Typhoon May 2023","url":"https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/"},{"source":"Joint Cybersecurity Advisory Volt Typhoon June 2023","url":"https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF"}]},{"technique_id":"T1685.005","description":"Volt Typhoon has selectively cleared Windows Event Logs, system logs, and other technical artifacts to remove evidence of intrusion activity.","sources":[{"source":"CISA AA24-038A PRC Critical Infrastructure February 2024","url":"https://www.cisa.gov/sites/default/files/2024-03/aa24-038a_csa_prc_state_sponsored_actors_compromise_us_critical_infrastructure_3.pdf"}]}]},{"id":"G1050","name":"Water Galura","procedures":[{"technique_id":"T1486","description":"Water Galura has encrypted files on victim networks through the generation of Qilin ransomware payloads.","sources":[{"source":"BushidoToken Qilin RaaS JUN 2024","url":"https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html"}]},{"technique_id":"T1585.001","description":"Water Galura operates a news channel on Telegram to make announcements for the Qilin RaaS.","sources":[{"source":"BushidoToken Qilin RaaS JUN 2024","url":"https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html"}]},{"technique_id":"T1657","description":"Water Galura has extorted victims for ransomware decryption keys and to prevent publication of data exfiltrated to their Tor data leak site.","sources":[{"source":"HC3 Qilin Threat Profile JUN 2024","url":"https://www.aha.org/system/files/media/file/2024/06/tlp-clear-hc3-threat-profile-qilin-aka-agenda-ransomware-6-18-2024.pdf"},{"source":"BushidoToken Qilin RaaS JUN 2024","url":"https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html"}]}]},{"id":"G0107","name":"Whitefly","procedures":[{"technique_id":"T1003.001","description":"Whitefly has used Mimikatz to obtain credentials.","sources":[{"source":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}]},{"technique_id":"T1027.013","description":"Whitefly has encrypted the payload used for C2.","sources":[{"source":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}]},{"technique_id":"T1036.005","description":"Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.","sources":[{"source":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}]},{"technique_id":"T1059","description":"Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.","sources":[{"source":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}]},{"technique_id":"T1068","description":"Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers.","sources":[{"source":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}]},{"technique_id":"T1105","description":"Whitefly has the ability to download additional tools from the C2.","sources":[{"source":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}]},{"technique_id":"T1204.002","description":"Whitefly has used malicious .exe or .dll files disguised as documents or images.","sources":[{"source":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}]},{"technique_id":"T1574.001","description":"Whitefly has used search order hijacking to run the loader Vcrodat.","sources":[{"source":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}]},{"technique_id":"T1588.002","description":"Whitefly has obtained and used tools such as Mimikatz.","sources":[{"source":"Symantec Whitefly March 2019","url":"https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/whitefly-espionage-singapore"}]}]},{"id":"G0124","name":"Windigo","procedures":[{"technique_id":"T1005","description":"Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.","sources":[{"source":"ESET ForSSHe December 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"technique_id":"T1059","description":"Windigo has used a Perl script for information gathering.","sources":[{"source":"ESET ForSSHe December 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"technique_id":"T1082","description":"Windigo has used a script to detect which Linux distribution and version is currently installed on the system.","sources":[{"source":"ESET ForSSHe December 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"technique_id":"T1083","description":"Windigo has used a script to check for the presence of files created by OpenSSH backdoors.","sources":[{"source":"ESET ForSSHe December 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]},{"technique_id":"T1090","description":"Windigo has delivered a generic Windows proxy Win32/Glubteta.M. Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.","sources":[{"source":"ESET Windigo Mar 2014","url":"https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/"}]},{"technique_id":"T1189","description":"Windigo has distributed Windows malware via drive-by downloads.","sources":[{"source":"ESET Windigo Mar 2014","url":"https://www.welivesecurity.com/2014/03/18/operation-windigo-the-vivisection-of-a-large-linux-server-side-credential-stealing-malware-campaign/"}]},{"technique_id":"T1518","description":"Windigo has used a script to detect installed software on targeted systems.","sources":[{"source":"ESET ForSSHe December 2018","url":"https://www.welivesecurity.com/wp-content/uploads/2018/12/ESET-The_Dark_Side_of_the_ForSSHe.pdf"}]}]},{"id":"G0112","name":"Windshift","procedures":[{"technique_id":"T1027","description":"Windshift has used string encoding with floating point calculations.","sources":[{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1033","description":"Windshift has used malware to identify the username on a compromised host.","sources":[{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1036","description":"Windshift has used icons mimicking MS Office files to mask malicious executables. Windshift has also attempted to hide executables by changing the file extension to \".scr\" to mimic Windows screensavers.","sources":[{"source":"objective-see windtail1 dec 2018","url":"https://objective-see.com/blog/blog_0x3B.html"},{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1036.001","description":"Windshift has used revoked certificates to sign malware.","sources":[{"source":"SANS Windshift August 2018","url":"https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"},{"source":"objective-see windtail1 dec 2018","url":"https://objective-see.com/blog/blog_0x3B.html"}]},{"technique_id":"T1047","description":"Windshift has used WMI to collect information about target machines.","sources":[{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1057","description":"Windshift has used malware to enumerate active processes.","sources":[{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1059.005","description":"Windshift has used Visual Basic 6 (VB6) payloads.","sources":[{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1071.001","description":"Windshift has used tools that communicate with C2 over HTTP.","sources":[{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1082","description":"Windshift has used malware to identify the computer name of a compromised host.","sources":[{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1105","description":"Windshift has used tools to deploy additional payloads to compromised hosts.","sources":[{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1189","description":"Windshift has used compromised websites to register custom URL schemes on a remote system.","sources":[{"source":"objective-see windtail1 dec 2018","url":"https://objective-see.com/blog/blog_0x3B.html"}]},{"technique_id":"T1204.001","description":"Windshift has used links embedded in e-mails to lure victims into executing malicious code.","sources":[{"source":"SANS Windshift August 2018","url":"https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"}]},{"technique_id":"T1204.002","description":"Windshift has used e-mail attachments to lure victims into executing malicious code.","sources":[{"source":"SANS Windshift August 2018","url":"https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"}]},{"technique_id":"T1518","description":"Windshift has used malware to identify installed software.","sources":[{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1518.001","description":"Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.","sources":[{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1547.001","description":"Windshift has created LNK files in the Startup folder to establish persistence.","sources":[{"source":"BlackBerry Bahamut","url":"https://www.blackberry.com/us/en/pdfviewer?file=/content/dam/blackberry-com/asset/enterprise/pdf/direct/report-spark-bahamut.pdf"}]},{"technique_id":"T1566.001","description":"Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.","sources":[{"source":"SANS Windshift August 2018","url":"https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"}]},{"technique_id":"T1566.002","description":"Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.","sources":[{"source":"SANS Windshift August 2018","url":"https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"}]},{"technique_id":"T1566.003","description":"Windshift has used fake personas on social media to engage and target victims.","sources":[{"source":"SANS Windshift August 2018","url":"https://www.scribd.com/document/661837258/WINDSHIFT-summit-archive-1554718868"}]}]},{"id":"G0044","name":"Winnti Group","procedures":[{"technique_id":"T1014","description":"Winnti Group used a rootkit to modify typical server functionality.","sources":[{"source":"Kaspersky Winnti April 2013","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}]},{"technique_id":"T1057","description":"Winnti Group looked for a specific process running on infected servers.","sources":[{"source":"Kaspersky Winnti April 2013","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}]},{"technique_id":"T1083","description":"Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.","sources":[{"source":"Kaspersky Winnti April 2013","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}]},{"technique_id":"T1105","description":"Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.","sources":[{"source":"Kaspersky Winnti April 2013","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}]},{"technique_id":"T1553.002","description":"Winnti Group used stolen certificates to sign its malware.","sources":[{"source":"Kaspersky Winnti April 2013","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}]},{"technique_id":"T1583.001","description":"Winnti Group has registered domains for C2 that mimicked sites of their intended targets.","sources":[{"source":"Kaspersky Winnti April 2013","url":"https://securelist.com/winnti-more-than-just-a-game/37029/"}]}]},{"id":"G1035","name":"Winter Vivern","procedures":[{"technique_id":"T1020","description":"Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.","sources":[{"source":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"}]},{"technique_id":"T1033","description":"Winter Vivern PowerShell scripts execute whoami to identify the executing user.","sources":[{"source":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"technique_id":"T1036","description":"Winter Vivern created specially-crafted documents mimicking legitimate government or similar documents during phishing campaigns.","sources":[{"source":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"technique_id":"T1036.004","description":"Winter Vivern has distributed malicious scripts and executables mimicking virus scanners.","sources":[{"source":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"technique_id":"T1041","description":"Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.","sources":[{"source":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"}]},{"technique_id":"T1053.005","description":"Winter Vivern executed PowerShell scripts that would subsequently attempt to establish persistence by creating scheduled tasks objects to periodically retrieve and execute remotely-hosted payloads.","sources":[{"source":"DomainTools WinterVivern 2021","url":"https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"}]},{"technique_id":"T1056.003","description":"Winter Vivern registered and hosted domains to allow for creation of web pages mimicking legitimate government email logon sites to collect logon information.","sources":[{"source":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"technique_id":"T1059","description":"Winter Vivern used XLM 4.0 macros for initial code execution for malicious document files.","sources":[{"source":"DomainTools WinterVivern 2021","url":"https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"}]},{"technique_id":"T1059.001","description":"Winter Vivern passed execution from document macros to PowerShell scripts during initial access operations. Winter Vivern used batch scripts that called PowerShell commands as part of initial access and installation operations.","sources":[{"source":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"},{"source":"DomainTools WinterVivern 2021","url":"https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"}]},{"technique_id":"T1059.003","description":"Winter Vivern distributed Windows batch scripts disguised as virus scanners to prompt download of malicious payloads using built-in system tools.","sources":[{"source":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"},{"source":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"technique_id":"T1059.007","description":"Winter Vivern delivered malicious JavaScript to exploit targets when exploiting Roundcube Webmail servers.","sources":[{"source":"ESET WinterVivern 2023","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"}]},{"technique_id":"T1071.001","description":"Winter Vivern uses HTTP and HTTPS protocols for exfiltration and command and control activity.","sources":[{"source":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"},{"source":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"technique_id":"T1082","description":"Winter Vivern script execution includes basic victim information gathering steps which are then transmitted to command and control servers.","sources":[{"source":"DomainTools WinterVivern 2021","url":"https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"}]},{"technique_id":"T1083","description":"Winter Vivern delivered malicious JavaScript payloads capable of listing folders and emails in exploited email servers.","sources":[{"source":"ESET WinterVivern 2023","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"}]},{"technique_id":"T1105","description":"Winter Vivern executed PowerShell scripts to create scheduled tasks to retrieve remotely-hosted payloads.","sources":[{"source":"DomainTools WinterVivern 2021","url":"https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"}]},{"technique_id":"T1113","description":"Winter Vivern delivered PowerShell scripts capable of taking screenshots of victim machines.","sources":[{"source":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"}]},{"technique_id":"T1114.001","description":"Winter Vivern delivered malicious JavaScript payloads capable of exfiltrating email messages from exploited email servers.","sources":[{"source":"ESET WinterVivern 2023","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"}]},{"technique_id":"T1119","description":"Winter Vivern delivered a PowerShell script capable of recursively scanning victim machines looking for various file types before exfiltrating identified files via HTTP.","sources":[{"source":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"}]},{"technique_id":"T1140","description":"Winter Vivern delivered exploit payloads via base64-encoded payloads in malicious email messages.","sources":[{"source":"ESET WinterVivern 2023","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"}]},{"technique_id":"T1189","description":"Winter Vivern created dedicated web pages mimicking legitimate government websites to deliver malicious fake anti-virus software.","sources":[{"source":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"}]},{"technique_id":"T1190","description":"Winter Vivern has exploited known and zero-day vulnerabilities in software usch as Roundcube Webmail servers and the \"Follina\" vulnerability.","sources":[{"source":"ESET WinterVivern 2023","url":"https://www.welivesecurity.com/en/eset-research/winter-vivern-exploits-zero-day-vulnerability-roundcube-webmail-servers/"},{"source":"Proofpoint WinterVivern 2023","url":"https://www.proofpoint.com/us/blog/threat-insight/exploitation-dish-best-served-cold-winter-vivern-uses-known-zimbra-vulnerability"}]},{"technique_id":"T1204.001","description":"Winter Vivern has mimicked legitimate government-related domains to deliver malicious webpages containing links to documents or other content for user execution.","sources":[{"source":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"},{"source":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"technique_id":"T1566.001","description":"Winter Vivern leverages malicious attachments delivered via email for initial access activity.","sources":[{"source":"CERT-UA WinterVivern 2023","url":"https://cert.gov.ua/article/3761104"},{"source":"DomainTools WinterVivern 2021","url":"https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"},{"source":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"technique_id":"T1583.001","description":"Winter Vivern registered domains mimicking other entities throughout various campaigns.","sources":[{"source":"DomainTools WinterVivern 2021","url":"https://www.domaintools.com/resources/blog/winter-vivern-a-look-at-re-crafted-government-maldocs/"}]},{"technique_id":"T1583.003","description":"Winter Vivern used adversary-owned and -controlled servers to host web vulnerability scanning applications.","sources":[{"source":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"technique_id":"T1584.006","description":"Winter Vivern has used compromised WordPress sites to host malicious payloads for download.","sources":[{"source":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]},{"technique_id":"T1595.002","description":"Winter Vivern has used remotely-hosted instances of the Acunetix vulnerability scanner.","sources":[{"source":"SentinelOne WinterVivern 2023","url":"https://www.sentinelone.com/labs/winter-vivern-uncovering-a-wave-of-global-espionage/"}]}]},{"id":"G0090","name":"WIRTE","procedures":[{"technique_id":"T1027.010","description":"WIRTE has XOR encrypted command line strings to conceal malware execution chains.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"technique_id":"T1027.015","description":"WIRTE has compressed malicious files within RAR and ZIP archives for obfuscation.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"},{"source":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"technique_id":"T1036.005","description":"WIRTE has used security service provider naming conventions such as ESET and Kasperky (\"Kaspersky Update Agent\") in order to appear legitimate.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"},{"source":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"technique_id":"T1041","description":"WIRTE has exfiltrated collected victim data to C2 infrastructure.","sources":[{"source":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"technique_id":"T1059.001","description":"WIRTE has used PowerShell for script execution.","sources":[{"source":"Lab52 WIRTE Apr 2019","url":"https://lab52.io/blog/wirte-group-attacking-the-middle-east/"}]},{"technique_id":"T1059.003","description":"WIRTE has used the Windows command line as part of infection chains to open documents.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"technique_id":"T1059.005","description":"WIRTE has used VBScript in its operations.","sources":[{"source":"Lab52 WIRTE Apr 2019","url":"https://lab52.io/blog/wirte-group-attacking-the-middle-east/"}]},{"technique_id":"T1071.001","description":"WIRTE has used HTTP for network communication.","sources":[{"source":"Lab52 WIRTE Apr 2019","url":"https://lab52.io/blog/wirte-group-attacking-the-middle-east/"}]},{"technique_id":"T1074.001","description":"WIRTE has staged collected documents of interest in C:\\Users\\Public folder.","sources":[{"source":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"technique_id":"T1105","description":"WIRTE has downloaded PowerShell code from the C2 server to be executed.","sources":[{"source":"Lab52 WIRTE Apr 2019","url":"https://lab52.io/blog/wirte-group-attacking-the-middle-east/"}]},{"technique_id":"T1106","description":"WIRTE has used the RtlIpv4StringToAddressA to convert IP-formatted string to a byte array.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"technique_id":"T1114.001","description":"WIRTE has collected documents from victims' email accounts.","sources":[{"source":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"technique_id":"T1140","description":"WIRTE has used Base64 to decode malicious VBS script.","sources":[{"source":"Lab52 WIRTE Apr 2019","url":"https://lab52.io/blog/wirte-group-attacking-the-middle-east/"}]},{"technique_id":"T1204.001","description":"WIRTE has used links embedded in emails to lure users into downloading malicious files.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"technique_id":"T1204.002","description":"WIRTE has attempted to lure users into opening malicious documents including MS Word and Excel files, at times using a decoy document to encourage execution of malicious payloads.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"},{"source":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"},{"source":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"technique_id":"T1218.010","description":"WIRTE has used regsvr32.exe to trigger the execution of a malicious script.","sources":[{"source":"Lab52 WIRTE Apr 2019","url":"https://lab52.io/blog/wirte-group-attacking-the-middle-east/"}]},{"technique_id":"T1497.001","description":"WIRTE has configured C2 servers to check location and user-agent strings for victim endpoints to prevent sending a payload to sandboxed environments.","sources":[{"source":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"technique_id":"T1566.001","description":"WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.","sources":[{"source":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"technique_id":"T1566.002","description":"WIRTE has sent targeted spearphishing emails with malicious links directing victims to malware downloads.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"technique_id":"T1571","description":"WIRTE has used HTTPS over ports 2083 and 2087 for C2.","sources":[{"source":"Kaspersky WIRTE November 2021","url":"https://securelist.com/wirtes-campaign-in-the-middle-east-living-off-the-land-since-at-least-2019/105044"}]},{"technique_id":"T1574.001","description":"WIRTE has used RAR archives containing a legitimate executable and a lure document to execute malicious DLLs via sideloading.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"technique_id":"T1583.001","description":"WIRTE has registered domains designed to mimic legitimate sites for use in phishing campaigns.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"},{"source":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"technique_id":"T1586.002","description":"WIRTE has used compromised emails, including one belonging to an Israel-based technology reseller, to deliver targeted spearphishing messages.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]},{"technique_id":"T1588.002","description":"WIRTE has obtained and used Empire and Rclone for post-exploitation activities.","sources":[{"source":"Lab52 WIRTE Apr 2019","url":"https://lab52.io/blog/wirte-group-attacking-the-middle-east/"},{"source":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"technique_id":"T1608.001","description":"WIRTE has directed victims to malicious payloads staged on file sharing services.","sources":[{"source":"Palo Alto Ashen Lepus DEC 2025","url":"https://unit42.paloaltonetworks.com/hamas-affiliate-ashen-lepus-uses-new-malware-suite-ashtag/"}]},{"technique_id":"T1684.001","description":"WIRTE has used utilized look-alike domains and graphics of trusted security solution providers to entice victims to click on phishing links.","sources":[{"source":"Check Point Wirte NOV 2024","url":"https://research.checkpoint.com/2024/hamas-affiliated-threat-actor-expands-to-disruptive-activity/"}]}]},{"id":"G0102","name":"Wizard Spider","procedures":[{"technique_id":"T1003.001","description":"Wizard Spider has dumped the lsass.exe memory to harvest credentials with the use of open-source tool LaZagne.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1003.002","description":"Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.","sources":[{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"}]},{"technique_id":"T1003.003","description":"Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database. Wizard Spider has also created a volume shadow copy and used a batch script file to collect NTDS.dit with the use of the Windows utility, ntdsutil.","sources":[{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1005","description":"Wizard Spider has collected data from a compromised host prior to exfiltration.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1016","description":"Wizard Spider has used ipconfig to identify the network configuration of a victim machine. Wizard Spider has also used the PowerShell cmdlet Get-ADComputer to collect IP address data from Active Directory.","sources":[{"source":"Sophos New Ryuk Attack October 2020","url":"https://news.sophos.com/en-us/2020/10/14/inside-a-new-ryuk-ransomware-attack/"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1018","description":"Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind, nltest/dclist, and PowerShell script Get-DataInfo.ps1 to enumerate domain computers, including the domain controller.","sources":[{"source":"Red Canary Hospital Thwarted Ryuk October 2020","url":"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"},{"source":"FireEye Ryuk and Trickbot January 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"},{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"technique_id":"T1021","description":"Wizard Spider has used the WebDAV protocol to execute Ryuk payloads hosted on network file shares.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1021.001","description":"Wizard Spider has used RDP for lateral movement and to deploy ransomware interactively.","sources":[{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source":"DFIR Ryuk 2 Hour Speed Run November 2020","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"}]},{"technique_id":"T1021.002","description":"Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.","sources":[{"source":"DFIR Ryuk 2 Hour Speed Run November 2020","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"},{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"technique_id":"T1021.006","description":"Wizard Spider has used Window Remote Management to move laterally through a victim network.","sources":[{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"}]},{"technique_id":"T1027.010","description":"Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands.","sources":[{"source":"FireEye Ryuk and Trickbot January 2019","url":"https://www.fireeye.com/blog/threat-research/2019/01/a-nasty-trick-from-credential-theft-malware-to-business-disruption.html"},{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"technique_id":"T1033","description":"Wizard Spider has used \"whoami\" to identify the local user and their privileges.","sources":[{"source":"Sophos New Ryuk Attack October 2020","url":"https://news.sophos.com/en-us/2020/10/14/inside-a-new-ryuk-ransomware-attack/"}]},{"technique_id":"T1036.004","description":"Wizard Spider has used scheduled tasks to install TrickBot, using task names to appear legitimate such as WinDotNet, GoogleTask, or Sysnetsf. It has also used common document file names for other malware binaries.","sources":[{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"}]},{"technique_id":"T1041","description":"Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.","sources":[{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1047","description":"Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally. Wizard Spider has also used batch scripts to leverage WMIC to deploy ransomware.","sources":[{"source":"Red Canary Hospital Thwarted Ryuk October 2020","url":"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"},{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1048.003","description":"Wizard Spider has exfiltrated victim information using FTP.","sources":[{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"},{"source":"DFIR Ryuk 2 Hour Speed Run November 2020","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"}]},{"technique_id":"T1053.005","description":"Wizard Spider has used scheduled tasks to establish persistence for TrickBot and other malware.","sources":[{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source":"DFIR Ryuk 2 Hour Speed Run November 2020","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"}]},{"technique_id":"T1055","description":"Wizard Spider has used process injection to execute payloads to escalate privileges.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1055.001","description":"Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.","sources":[{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source":"DFIR Ryuk 2 Hour Speed Run November 2020","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"}]},{"technique_id":"T1059.001","description":"Wizard Spider has used macros to execute PowerShell scripts to download malware on victim's machines. It has also used PowerShell to execute commands and move laterally through a victim network.","sources":[{"source":"Red Canary Hospital Thwarted Ryuk October 2020","url":"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"},{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1059.003","description":"Wizard Spider has used cmd.exe to execute commands on a victim's machine.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"technique_id":"T1070.004","description":"Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.","sources":[{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"}]},{"technique_id":"T1071.001","description":"Wizard Spider has used HTTP for network communications.","sources":[{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"}]},{"technique_id":"T1074","description":"Wizard Spider has collected and staged credentials and network enumeration information, using the networkdll and psfin TrickBot modules.","sources":[{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"}]},{"technique_id":"T1074.001","description":"Wizard Spider has staged ZIP files in local directories such as, C:\\PerfLogs\\1\\ and C:\\User\\1\\ prior to exfiltration.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1078","description":"Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.","sources":[{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1078.002","description":"Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.","sources":[{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"}]},{"technique_id":"T1082","description":"Wizard Spider has used Systeminfo and similar commands to acquire detailed configuration information of a victim's machine. Wizard Spider has also utilized the PowerShell cmdlet Get-ADComputer to collect DNS hostnames, last logon dates, and operating system information from Active Directory.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"technique_id":"T1087.002","description":"Wizard Spider has identified domain admins through the use of net group \"Domain admins\" /DOMAIN. Wizard Spider has also leveraged the PowerShell cmdlet Get-ADComputer to collect account names from Active Directory data.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"technique_id":"T1105","description":"Wizard Spider can transfer malicious payloads such as ransomware to compromised machines.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1112","description":"Wizard Spider has modified the Registry key HKLM\\System\\CurrentControlSet\\Control\\SecurityProviders\\WDigest by setting the UseLogonCredential registry value to 1 in order to force credentials to be stored in clear text in memory. Wizard Spider has also modified the WDigest registry key to allow plaintext credentials to be cached in memory.","sources":[{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1133","description":"Wizard Spider has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.","sources":[{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"}]},{"technique_id":"T1135","description":"Wizard Spider has used the “net view” command to locate mapped network shares.","sources":[{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"}]},{"technique_id":"T1136.001","description":"Wizard Spider has created local administrator accounts to maintain persistence in compromised networks.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1136.002","description":"Wizard Spider has created and used new accounts within a victim's Active Directory environment to maintain persistence.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1197","description":"Wizard Spider has used batch scripts that utilizes WMIC to execute a BITSAdmin transfer of a ransomware payload to each compromised machine.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1204.001","description":"Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.","sources":[{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"}]},{"technique_id":"T1204.002","description":"Wizard Spider has lured victims to execute malware with spearphishing attachments containing macros to download either Emotet, Bokbot, TrickBot, or Bazar.","sources":[{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"CrowdStrike Wizard Spider October 2020","url":"https://www.crowdstrike.com/blog/wizard-spider-adversary-update/"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1210","description":"Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.","sources":[{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"},{"source":"DFIR Ryuk in 5 Hours October 2020","url":"https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/"}]},{"technique_id":"T1218.011","description":"Wizard Spider has utilized rundll32.exe to deploy ransomware commands with the use of WebDAV.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1222.001","description":"Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.","sources":[{"source":"Sophos New Ryuk Attack October 2020","url":"https://news.sophos.com/en-us/2020/10/14/inside-a-new-ryuk-ransomware-attack/"}]},{"technique_id":"T1489","description":"Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.","sources":[{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"technique_id":"T1490","description":"Wizard Spider has used WMIC and vssadmin to manually delete volume shadow copies. Wizard Spider has also used Conti ransomware to delete volume shadow copies automatically with the use of vssadmin.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1518.001","description":"Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.","sources":[{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"technique_id":"T1518.002","description":"Wizard Spider has utilized the PowerShell script Get-DataInfo.ps1 to collect installed backup software information from a compromised machine.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1543.003","description":"Wizard Spider has installed TrickBot as a service named ControlServiceA in order to establish persistence.","sources":[{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1547.001","description":"Wizard Spider has established persistence via the Registry key HKCU\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run and a shortcut within the startup folder.","sources":[{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"}]},{"technique_id":"T1547.004","description":"Wizard Spider has established persistence using Userinit by adding the Registry key HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon.","sources":[{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"}]},{"technique_id":"T1550.002","description":"Wizard Spider has used the Invoke-SMBExec PowerShell cmdlet to execute the pass-the-hash technique and utilized stolen password hashes to move laterally.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1552.006","description":"Wizard Spider has used PowerShell cmdlets Get-GPPPassword and Find-GPOPassword to find unsecured credentials in a compromised network group policy.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1553.002","description":"Wizard Spider has used Digicert code-signing certificates for some of its malware.","sources":[{"source":"DFIR Ryuk 2 Hour Speed Run November 2020","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"}]},{"technique_id":"T1555.004","description":"Wizard Spider has used PowerShell cmdlet Invoke-WCMDump to enumerate Windows credentials in the Credential Manager in a compromised network.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1557.001","description":"Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.","sources":[{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"}]},{"technique_id":"T1558.003","description":"Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.","sources":[{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source":"DFIR Ryuk 2 Hour Speed Run November 2020","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"},{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"technique_id":"T1560.001","description":"Wizard Spider has archived data into ZIP files on compromised machines.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1566.001","description":"Wizard Spider has used spearphishing attachments to deliver Microsoft documents containing macros or PDFs containing malicious links to download either Emotet, Bokbot, TrickBot, or Bazar.","sources":[{"source":"Red Canary Hospital Thwarted Ryuk October 2020","url":"https://redcanary.com/blog/how-one-hospital-thwarted-a-ryuk-ransomware-outbreak/"},{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1566.002","description":"Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.","sources":[{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source":"DFIR Ryuk 2 Hour Speed Run November 2020","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"}]},{"technique_id":"T1567.002","description":"Wizard Spider has exfiltrated stolen victim data to various cloud storage providers.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1569.002","description":"Wizard Spider has used services.exe to execute scripts and executables during lateral movement within a victim's network. Wizard Spider has also used batch scripts that leverage PsExec to execute a previously transferred ransomware payload on a victim's network.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source":"DFIR Ryuk in 5 Hours October 2020","url":"https://thedfirreport.com/2020/10/18/ryuk-in-5-hours/"},{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]},{"technique_id":"T1570","description":"Wizard Spider has used stolen credentials to copy tools into the %TEMP% directory of domain controllers.","sources":[{"source":"CrowdStrike Grim Spider May 2019","url":"https://www.crowdstrike.com/blog/timelining-grim-spiders-big-game-hunting-tactics/"}]},{"technique_id":"T1585.002","description":"Wizard Spider has leveraged ProtonMail email addresses in ransom notes when delivering Ryuk ransomware.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1588.002","description":"Wizard Spider has utilized tools such as Empire, Cobalt Strike, Cobalt Strike, Rubeus, AdFind, BloodHound, Metasploit, Advanced IP Scanner, Nirsoft PingInfoView, and SoftPerfect Network Scanner for targeting efforts.","sources":[{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"}]},{"technique_id":"T1588.003","description":"Wizard Spider has obtained code signing certificates signed by DigiCert, GlobalSign, and COMOOD for malware payloads.","sources":[{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source":"DFIR Ryuk 2 Hour Speed Run November 2020","url":"https://thedfirreport.com/2020/11/05/ryuk-speed-run-2-hours-to-ransom/"}]},{"technique_id":"T1685","description":"Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.","sources":[{"source":"DHS/CISA Ransomware Targeting Healthcare October 2020","url":"https://us-cert.cisa.gov/ncas/alerts/aa20-302a"},{"source":"FireEye KEGTAP SINGLEMALT October 2020","url":"https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html"},{"source":"Mandiant FIN12 Oct 2021","url":"https://web.archive.org/web/20220313061955/https://www.mandiant.com/sites/default/files/2021-10/fin12-group-profile.pdf"},{"source":"DFIR Ryuk's Return October 2020","url":"https://thedfirreport.com/2020/10/08/ryuks-return/"}]}]},{"id":"G0128","name":"ZIRCONIUM","procedures":[{"technique_id":"T1012","description":"ZIRCONIUM has used a tool to query the Registry for proxy settings.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1016","description":"ZIRCONIUM has used a tool to enumerate proxy settings in the target environment.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1027.002","description":"ZIRCONIUM has used multi-stage packers for exploit code.","sources":[{"source":"Check Point APT31 February 2021","url":"https://research.checkpoint.com/2021/the-story-of-jian/"}]},{"technique_id":"T1033","description":"ZIRCONIUM has used a tool to capture the username on a compromised host in order to register it with C2.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1036","description":"ZIRCONIUM has spoofed legitimate applications in phishing lures and changed file extensions to conceal installation of malware.","sources":[{"source":"Google Election Threats October 2020","url":"https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/"},{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1036.004","description":"ZIRCONIUM has created a run key named Dropbox Update Setup to mask a persistence mechanism for a malicious binary.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1041","description":"ZIRCONIUM has exfiltrated files via the Dropbox API C2.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1059.003","description":"ZIRCONIUM has used a tool to open a Windows Command Shell on a remote host.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1059.006","description":"ZIRCONIUM has used Python-based implants to interact with compromised hosts.","sources":[{"source":"Google Election Threats October 2020","url":"https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/"},{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1068","description":"ZIRCONIUM has exploited CVE-2017-0005 for local privilege escalation.","sources":[{"source":"Check Point APT31 February 2021","url":"https://research.checkpoint.com/2021/the-story-of-jian/"}]},{"technique_id":"T1082","description":"ZIRCONIUM has used a tool to capture the processor architecture of a compromised host in order to register it with C2.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1090.003","description":"ZIRCONIUM has utilized an ORB (operational relay box) network – consisting compromised devices such as small office and home office (SOHO) routers, IoT devices, and leased virtual private servers (VPS) – to proxy traffic.","sources":[{"source":"ORB Mandiant","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"}]},{"technique_id":"T1102.002","description":"ZIRCONIUM has used Dropbox for C2 allowing upload and download of files as well as execution of arbitrary commands.","sources":[{"source":"Google Election Threats October 2020","url":"https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/"},{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1105","description":"ZIRCONIUM has used tools to download malicious files to compromised hosts.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1124","description":"ZIRCONIUM has used a tool to capture the time on a compromised host in order to register it with C2.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1140","description":"ZIRCONIUM has used the AES256 algorithm with a SHA1 derived key to decrypt exploit code.","sources":[{"source":"Check Point APT31 February 2021","url":"https://research.checkpoint.com/2021/the-story-of-jian/"}]},{"technique_id":"T1204.001","description":"ZIRCONIUM has used malicious links in e-mails to lure victims into downloading malware.","sources":[{"source":"Google Election Threats October 2020","url":"https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/"},{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1218.007","description":"ZIRCONIUM has used the msiexec.exe command-line utility to download and execute malicious MSI files.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1547.001","description":"ZIRCONIUM has created a Registry Run key named Dropbox Update Setup to establish persistence for a malicious Python binary.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1555.003","description":"ZIRCONIUM has used a tool to steal credentials from installed web browsers including Microsoft Internet Explorer and Google Chrome.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1566.002","description":"ZIRCONIUM has used malicious links in e-mails to deliver malware.","sources":[{"source":"Microsoft Targeting Elections September 2020","url":"https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/"},{"source":"Google Election Threats October 2020","url":"https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/"},{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1567.002","description":"ZIRCONIUM has exfiltrated stolen data to Dropbox.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1573.001","description":"ZIRCONIUM has used AES encrypted communications in C2.","sources":[{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1583.001","description":"ZIRCONIUM has purchased domains for use in targeted campaigns.","sources":[{"source":"Microsoft Targeting Elections September 2020","url":"https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/"}]},{"technique_id":"T1583.006","description":"ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.","sources":[{"source":"Google Election Threats October 2020","url":"https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/"},{"source":"Zscaler APT31 Covid-19 October 2020","url":"https://www.zscaler.com/blogs/security-research/apt-31-leverages-covid-19-vaccine-theme-and-abuses-legitimate-online"}]},{"technique_id":"T1584.008","description":"ZIRCONIUM has compromised network devices such as small office and home office (SOHO) routers and IoT devices for ORB (operational relay box) Proxy networks.","sources":[{"source":"ORB APT31","url":"https://therecord.media/chinese-hacking-group-apt31-uses-mesh-of-home-routers-to-disguise-attacks"},{"source":"ORB Mandiant","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"}]},{"technique_id":"T1598","description":"ZIRCONIUM targeted presidential campaign staffers with credential phishing e-mails.","sources":[{"source":"Google Election Threats October 2020","url":"https://blog.google/threat-analysis-group/how-were-tackling-evolving-online-threats/"}]},{"technique_id":"T1598.003","description":"ZIRCONIUM has used web beacons in e-mails to track hits to attacker-controlled URL's.","sources":[{"source":"Microsoft Targeting Elections September 2020","url":"https://blogs.microsoft.com/on-the-issues/2020/09/10/cyberattacks-us-elections-trump-biden/"}]},{"technique_id":"T1665","description":"ZIRCONIUM has utilized an ORB (operational relay box) network – consisting compromised devices such as small office and home office (SOHO) routers, IoT devices, and leased virtual private servers (VPS) – to obfuscate the origin of C2 traffic.","sources":[{"source":"ORB Mandiant","url":"https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-espionage-orb-networks"}]}]}]}