Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Patchwork attempted to use RDP to move laterally.(Citation: Cymmetria Patchwork)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” (the installation path of the “360 Total Security” antivirus tool).(Citation: Cymmetria Patchwork)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server.

Patchwork also enumerated all available drives on the victim's machine.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor."(Citation: Cymmetria Patchwork) They have also dropped

QuasarRAT binaries as files named microsoft_network.exe and crome.exe.(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|


Patchwork dumped the login data database from

Patchwork used Base64 to encode C2 traffic.(Citation: Cymmetria Patchwork)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Patchwork ran a reverse shell with Meterpreter.(Citation: Cymmetria Patchwork)

Patchwork used JavaScript code and .SCT files on victim machines.(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Patchwork used

PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1548.002|Bypass User Account Control|

Patchwork bypassed User Access Control (UAC).(Citation: Cymmetria Patchwork)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Patchwork collected and exfiltrated files from the infected system.(Citation: Cymmetria Patchwork)|


PittyTiger - G0011

Created: 2017-05-31T21:31:50.198Z

Modified: 2021-10-12T23:11:41.368Z

Contributors:

Aliases

PittyTiger

Description

PittyTiger is a threat group believed to operate out of China that uses multiple different types of malware to maintain command and control.(Citation: Bizeul 2014)(Citation: Villeneuve 2014)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|PittyTiger has obtained and used tools such as Mimikatz and gsecdump.(Citation: Bizeul 2014)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|PittyTiger attempts to obtain legitimate credentials during operations.(Citation: Bizeul 2014)|


PLATINUM - G0068

Created: 2018-04-18T17:59:24.739Z

Modified: 2021-04-22T00:39:49.529Z

Contributors: Ryan Becwar

Aliases

PLATINUM

Description

PLATINUM is an activity group that has targeted victims since at least 2009. The group has focused on targets associated with governments and related organizations in South and Southeast Asia. (Citation: Microsoft PLATINUM April 2016)

Techniques Used

PLATINUM has renamed rar.exe to avoid detection.(Citation: Twitter ItsReallyNick Platinum Masquerade)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

PLATINUM has transferred files using the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel.(Citation: Microsoft PLATINUM June 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

PLATINUM has used several different keyloggers.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

PLATINUM has sometimes used drive-by attacks against vulnerable browser plugins.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

PLATINUM has used various methods of process injection including hot patching.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

PLATINUM has leveraged a zero-day vulnerability to escalate privileges.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|


PLATINUM has used keyloggers that are also capable of dumping credentials.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

PLATINUM has sent spearphishing emails with attachments to victims as its primary initial access vector.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Windows|T1056.004|Credential API Hooking|

PLATINUM is capable of using Windows hook interfaces for information gathering such as credential access.(Citation: Microsoft PLATINUM April 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|

PLATINUM has used the Intel® Active Management Technology (AMT) Serial-over-LAN (SOL) channel for command and control.(Citation: Microsoft PLATINUM June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

PLATINUM has attempted to get users to open malicious files by sending spearphishing emails with attachments to victims.(Citation: Microsoft PLATINUM April 2016)|


POLONIUM - G1005

Created: 2022-07-01T19:07:04.253Z

Modified: 2022-08-10T12:31:10.192Z

Contributors:

Aliases

POLONIUM

Description

POLONIUM is a Lebanon-based group that has primarily targeted Israeli organizations, including critical manufacturing, information technology, and defense industry companies, since at least February 2022. Security researchers assess POLONIUM has coordinated their operations with multiple actors affiliated with Iran’s Ministry of Intelligence and Security (MOIS), based on victim overlap as well as common techniques and tooling.(Citation: Microsoft POLONIUM June 2022)

Techniques Used

POLONIUM has exfiltrated stolen data to

POLONIUM-owned OneDrive and Dropbox accounts.(Citation: Microsoft POLONIUM June 2022) |
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

POLONIUM has obtained and used tools such as AirVPN and plink in their operations.(Citation: Microsoft POLONIUM June 2022) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

POLONIUM has used OneDrive and DropBox for C2.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

POLONIUM has used the AirVPN service for operational activity.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

POLONIUM has used valid compromised credentials to gain access to victim environments.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|


POLONIUM has used compromised credentials from an IT company to target downstream customers including a law firm and aviation company.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations.(Citation: Microsoft POLONIUM June 2022)|


Poseidon Group - G0033

Created: 2017-05-31T21:32:04.179Z

Modified: 2020-03-18T20:25:54.945Z

Contributors:

Aliases

Poseidon Group

Description

Poseidon Group is a Portuguese-speaking threat group that has been active since at least 2005. The group has a history of using information exfiltrated from victims to blackmail victim companies into contracting the Poseidon Group as a security firm. (Citation: Kaspersky Poseidon Group)

Techniques Used

Poseidon Group searches for administrator accounts on both the local victim machine and the network.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|

Poseidon Group searches for administrator accounts on both the local victim machine and the network.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|The

Poseidon Group's Information Gathering Tool (IGT) includes PowerShell components.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|After compromising a victim,

Poseidon Group lists all running processes.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|


Poseidon Group lists all running processes.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Poseidon Group obtains and saves information about victim network interfaces and addresses.(Citation: Kaspersky Poseidon Group)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|After compromising a victim,

Poseidon Group discovers all running services.(Citation: Kaspersky Poseidon Group)|


PROMETHIUM - G0056

Created: 2018-01-16T16:13:52.465Z

Modified: 2020-10-22T18:12:48.893Z

Contributors:

Aliases

PROMETHIUM,StrongPity

Description

PROMETHIUM is an activity group focused on espionage that has been active since at least 2012. The group has conducted operations globally with a heavy emphasis on Turkish targets. PROMETHIUM has demonstrated similarity to another activity group called NEODYMIUM due to overlapping victim and campaign characteristics.(Citation: Microsoft NEODYMIUM Dec 2016)(Citation: Microsoft SIR Vol 21)(Citation: Talos Promethium June 2020)

Techniques Used

PROMETHIUM has created self-signed certificates to sign malicious installers.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|PRE|T1587.003|Digital Certificates|

PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.(Citation: Talos Promethium June 2020)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

PROMETHIUM has created new services and modified existing services for persistence.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

PROMETHIUM has named services to appear legitimate.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

PROMETHIUM has created admin accounts on a compromised host.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1205.001|Port Knocking|


PROMETHIUM has used a script that configures the knockd service and firewall to only accept C2 connections from systems that use a specified sequence of knock ports.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

PROMETHIUM has attempted to get users to execute compromised installation files for legitimate software including compression applications, security software, browsers, file recovery applications, and other tools and utilities.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

PROMETHIUM has disguised malicious installer files by bundling them with legitimate software installers.(Citation: Talos Promethium June 2020)(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

PROMETHIUM has signed code with self-signed certificates.(Citation: Bitdefender StrongPity June 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

PROMETHIUM has used Registry run keys to establish persistence.(Citation: Talos Promethium June 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

PROMETHIUM has used watering hole attacks to deliver malicious versions of legitimate installers.(Citation: Bitdefender StrongPity June 2020)|


Putter Panda - G0024

Created: 2017-05-31T21:31:56.785Z

Modified: 2020-03-30T19:15:04.771Z

Contributors:

Aliases

Putter Panda,APT2,MSUpdater

Description

Putter Panda is a Chinese threat group that has been attributed to Unit 61486 of the 12th Bureau of the PLA’s 3rd General Staff Department (GSD). (Citation: CrowdStrike Putter Panda)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus (SAVAdminService.exe and SavService.exe).(Citation: CrowdStrike Putter Panda)|
|mitre-attack|enterprise-attack|Windows|T1055.001|Dynamic-link Library Injection|An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express (msinm.exe), Outlook (outlook.exe), Internet Explorer (iexplore.exe), and Firefox (firefox.exe).(Citation: CrowdStrike Putter Panda)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|A dropper used by Putter Panda installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.(Citation: CrowdStrike Putter Panda)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.(Citation: CrowdStrike Putter Panda)|


Rancor - G0075

Created: 2018-10-17T00:14:20.652Z

Modified: 2020-03-30T19:15:49.217Z

Contributors:

Aliases

Rancor

Description

Rancor is a threat group that has led targeted campaigns against the South East Asia region. Rancor uses politically-motivated lures to entice victims to open malicious documents. (Citation: Rancor Unit42 June 2018)

Techniques Used

Rancor has used VBS scripts as well as embedded macros for execution.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.007|Msiexec|

Rancor has used

Rancor has used HTTP for C2.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Rancor has used cmd.exe to execute commmands.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Rancor has downloaded additional malware, including by using

certutil.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Rancor has attached a malicious document to an email to gain initial access.(Citation: Rancor Unit42 June 2018)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Rancor launched a scheduled task to gain persistence using the


Rocke - G0106

Created: 2020-05-26T14:20:20.623Z

Modified: 2020-06-19T20:41:21.215Z

Contributors:

Aliases

Rocke

Description

Rocke is an alleged Chinese-speaking adversary whose primary objective appeared to be cryptojacking, or stealing victim system resources for the purposes of mining cryptocurrency. The name Rocke comes from the email address "rocke@live.cn" used to create the wallet which held collected cryptocurrency. Researchers have detected overlaps between Rocke and the Iron Cybercrime Group, though this attribution has not been confirmed.(Citation: Talos Rocke August 2018)

Techniques Used

Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071|Application Layer Protocol|

Rocke issued wget requests from infected systems to the C2.(Citation: Talos Rocke August 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

Rocke has used Pastebin, Gitee, and GitLab for Command and Control.(Citation: Anomali Rocke March 2019)(Citation: Talos Rocke August 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Rocke has extracted tar.gz files after downloading them from a C2 server.(Citation: Talos Rocke August 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Rocke has used shell scripts which download mining executables and saves them with the filename "java".(Citation: Talos Rocke August 2018)|
|mitre-attack|enterprise-attack|Linux,macOS|T1574.006|Dynamic Linker Hijacking|


Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.(Citation: Anomali Rocke March 2019)   |
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Rocke has used Python-based malware to install and spread their coinminer.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Rocke has modified UPX headers after packing files to break unpackers.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.004|Compile After Delivery|

Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection (GCC).(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

Rocke has spread its coinminer via SSH.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1552.004|Private Keys|

Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Rocke has used uname -m to collect the name and information about the infected system's kernel.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS|T1070.002|Clear Linux or Mac System Logs|

Rocke has cleared log files within the /var/log/ folder.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1496|Resource Hijacking|


Rocke has distributed cryptomining malware.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Rocke exploited Apache Struts, Oracle WebLogic (CVE-2017-10271), and Adobe ColdFusion (CVE-2017-3066) vulnerabilities to deliver malware.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Rocke used malware to download additional malicious files to the target system.(Citation: Talos Rocke August 2018) |
|mitre-attack|enterprise-attack|macOS,Linux|T1059.004|Unix Shell|

Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.(Citation: Talos Rocke August 2018) |
|mitre-attack|enterprise-attack|Linux,macOS|T1053.003|Cron|

Rocke installed a cron job that downloaded and executed files from the C2.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.(Citation: Talos Rocke August 2018)(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1562.004|Disable or Modify System Firewall|


Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.(Citation: Talos Rocke August 2018)  |
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Rocke used scripts which detected and uninstalled antivirus software.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Rocke used scripts which detected and uninstalled antivirus software.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|

Rocke downloaded a file "libprocesshider", which could hide files on the target system.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.(Citation: Talos Rocke August 2018)  |
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.(Citation: Talos Rocke August 2018)   |
|mitre-attack|enterprise-attack|Windows|T1055.002|Portable Executable Injection|

Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.(Citation: Talos Rocke August 2018)  |
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|


Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.(Citation: Talos Rocke August 2018)(Citation: Unit 42 Rocke January 2019)(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.001|Dead Drop Resolver|

Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.(Citation: Anomali Rocke March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Rocke has deleted files on infected machines.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Rocke can detect a running process's PID on the infected machine.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|macOS,Linux|T1222.002|Linux and Mac File and Directory Permissions Modification|

Rocke has changed file permissions of files so they could not be modified.(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.006|Timestomp|

Rocke has changed the time stamp of certain files.(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1037|Boot or Logon Initialization Scripts|

Rocke has installed an "init.d" startup script to maintain persistence.(Citation: Anomali Rocke March 2019) |
|mitre-attack|enterprise-attack|Linux|T1543.002|Systemd Service|

Rocke has installed a systemd service script to maintain persistence.(Citation: Anomali Rocke March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|


Rocke's miner connects to a C2 server using port 51640.(Citation: Anomali Rocke March 2019)    |


RTM - G0048

Created: 2017-05-31T21:32:10.206Z

Modified: 2020-05-12T22:16:44.650Z

Contributors: Oleg Skulkin, Group-IB

Aliases

RTM

Description

RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by the same name (RTM). (Citation: ESET RTM Feb 2017)

Techniques Used

RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.(Citation: Group IB RTM August 2019)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

RTM has used search order hijacking to force TeamViewer to load a malicious DLL.(Citation: Group IB RTM August 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

RTM has used a modified version of TeamViewer and Remote Utilities for remote access.(Citation: Group IB RTM August 2019)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

RTM has used Registry run keys to establish persistence for the

RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.(Citation: ESET RTM Feb 2017)(Citation: Group IB RTM August 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

RTM has used spearphishing attachments to distribute its malware.(Citation: Group IB RTM August 2019)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network

RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names.(Citation: ESET RTM Feb 2017)|


Sandworm Team - G0034

Created: 2017-05-31T21:32:04.588Z

Modified: 2023-03-08T22:12:31.238Z

Contributors: Dragos Threat Intelligence

Aliases

Sandworm Team,ELECTRUM,Telebots,IRON VIKING,BlackEnergy (Group),Quedagh,Voodoo Bear,IRIDIUM

Description

Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) This group has been active since at least 2009.(Citation: iSIGHT Sandworm 2014)(Citation: CrowdStrike VOODOO BEAR)(Citation: USDOJ Sandworm Feb 2020)(Citation: NCSC Sandworm Feb 2020)

In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020) Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.(Citation: US District Court Indictment GRU Oct 2018)

Techniques Used

Sandworm Team has used the commercially available tool RemoteExec for agentless remote code execution.(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|


Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.(Citation: ESET Telebots Dec 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1003.003|NTDS|

Sandworm Team has used

Sandworm Team has used

Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1584.005|Botnet|

Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.(Citation: NCSC Cyclops Blink February 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1047|Windows Management Instrumentation|

Sandworm Team has used

Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.(Citation: Dragos Crashoverride 2018)(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Sandworm Team has copied payloads to the

Sandworm Team has used

Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object.(Citation: Dragos Crashoverride 2018)(Citation: Microsoft Prestige ransomware October 2022) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,macOS,Linux|T1136.002|Domain Account|

Sandworm Team has created new domain accounts on an ICS access server.(Citation: Dragos Crashoverride 2018)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Sandworm Team has used webshells including


Sandworm Team has used webshells including

P.A.S. Webshell to maintain access to victim networks.(Citation: ANSSI Sandworm January 2021)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1589.002|Email Addresses|

Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1589.003|Employee Names|

Sandworm Team's research of potential victim organizations included the identification and collection of employee information.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1598.003|Spearphishing Link|

Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1592.002|Software|

Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017

NotPetya attack.

Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1593|Search Open Websites/Domains|

Sandworm Team researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the

NotPetya attack.


Sandworm Team researched Ukraine's unique legal entity identifier (called an "EDRPOU" number), including running queries on the EDRPOU website, in preparation for the

NotPetya attack.

Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Sandworm Team has collected the username from a compromised host.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Sandworm Team has enumerated files on a compromised host.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1591.002|Business Relationships|In preparation for its attack against the 2018 Winter Olympics,

Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1595.002|Vulnerability Scanning|


Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1588.006|Vulnerabilities|In 2017,

Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1588.002|Tool|

Sandworm Team has acquired open-source tools for their operations, including

Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to

Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as

Impacket and RemoteExec, which were used in their 2022

Prestige operations.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1059.001|PowerShell|

Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|


Sandworm Team has used stolen credentials to access administrative accounts within the domain.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1594|Search Victim-Owned Websites|

Sandworm Team has conducted research against potential victim websites as part of its operational planning.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,IaaS,Linux,macOS|T1491.002|External Defacement|

Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: UK NCSC Olympic Attacks October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1590.001|Domain Properties|

Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1499|Endpoint Denial of Service|

Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1583.004|Server|

Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1583.001|Domains|


Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Sandworm Team has crafted phishing emails containing malicious hyperlinks.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|

Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1585.002|Email Accounts|

Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1585.001|Social Media Accounts|

Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|PRE|T1587.001|Malware|

Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as

NotPetya and


Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as

NotPetya and

Olympic Destroyer.(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.(Citation: ESET Telebots Dec 2016)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Office 365,Google Workspace|T1087.003|Email Account|

Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.(Citation: ESET Telebots July 2017)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Sandworm Team used a backdoor to enumerate information about the infected system's operating system.(Citation: ESET Telebots July 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1218.011|Rundll32|

Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.(Citation: ESET Telebots July 2017)    |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1195.002|Compromise Software Supply Chain|

Sandworm Team has distributed


Sandworm Team has distributed

NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.(Citation: Secureworks NotPetya June 2017)(Citation: ESET Telebots June 2017)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

Sandworm Team has used port 6789 to accept connections on the group's SSH server.(Citation: ESET BlackEnergy Jan 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,Windows,macOS|T1219|Remote Access Software|

Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.(Citation: US-CERT Ukraine Feb 2016)(Citation: Microsoft Prestige ransomware October 2022)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network.

Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.(Citation: ESET BlackEnergy Jan 2016)(Citation: ESET Telebots June 2017)(Citation: ANSSI Sandworm January 2021)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Sandworm Team has created VBScripts to run an SSH server.(Citation: ESET BlackEnergy Jan 2016)(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)(Citation: Dragos Crashoverride 2018) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|


Sandworm Team have used previously acquired legitimate credentials prior to attacks.(Citation: US-CERT Ukraine Feb 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1561.002|Disk Structure Wipe|

Sandworm Team has used the

BlackEnergy KillDisk component to corrupt the infected system's master boot record.(Citation: US-CERT Ukraine Feb 2016)(Citation: ESET Telebots June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,IaaS,Linux,macOS|T1485|Data Destruction|

Sandworm Team has used the

BlackEnergy KillDisk component to overwrite files on Windows-based Human-Machine Interfaces. (Citation: US-CERT Ukraine Feb 2016)(Citation: ESET Telebots June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Sandworm Team has avoided detection by naming a malicious binary explorer.exe.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor.


Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor.

Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.(Citation: ESET Telebots Dec 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows|T1003.001|LSASS Memory|

Sandworm Team has used its plainpwd tool, a modified version of

Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots June 2017)(Citation: Microsoft Prestige ransomware October 2022)    |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.(Citation: ESET Telebots Dec 2016)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network,IaaS|T1040|Network Sniffing|


Sandworm Team has used intercepter-NG to sniff passwords in network traffic.(Citation: ESET Telebots Dec 2016)    |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1087.002|Domain Account|

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.(Citation: ESET Telebots Dec 2016)  |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

Sandworm Team has sent system information to its C2 server using HTTP.(Citation: ESET Telebots Dec 2016)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots July 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Sandworm Team has used backdoors that can delete files used in an attack from an infected system.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots July 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.(Citation: ESET Telebots Dec 2016)  |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1090|Proxy|


Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.(Citation: ESET Telebots Dec 2016)    |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.(Citation: ESET Telebots Dec 2016) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).(Citation: iSight Sandworm Oct 2014)(Citation: TrendMicro Sandworm October 2014)(Citation: McAfee Sandworm November 2013)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Sandworm Team has delivered malicious Microsoft Office attachments via spearphishing emails.(Citation: iSight Sandworm Oct 2014)(Citation: US-CERT Ukraine Feb 2016)(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Sandworm Team has used Base64 encoding within malware variants.(Citation: iSight Sandworm Oct 2014)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Control Server,Data Historian,Engineering Workstation,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0859|Valid Accounts|In the Ukraine 2015 Incident,


Sandworm Team used the credentials of valid accounts to interact with client applications and access employee workstations hosting HMI applications. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)(Citation: Dragos)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|None|T0884|Connection Proxy|

Sandworm Team establishes an internal proxy prior to the installation of backdoors within the network. (Citation: Dragos Inc. June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Human-Machine Interface|T0819|Exploit Public-Facing Application|

Sandworm Team actors exploited vulnerabilities in GE's Cimplicity HMI and Advantech/Broadwin WebAccess HMI software which had been directly exposed to the internet. (Citation: ICS-CERT December 2014) (Citation: ICS CERT September 2018)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED|T0855|Unauthorized Command Message|In the Ukraine 2015 Incident,

Sandworm Team issued unauthorized commands to substation breakers after gaining control of operator workstations and accessing a distribution management system (DMS) client application. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Safety Instrumented System/Protection Relay,Field Controller/RTU/PLC/IED,Input/Output Server|T0857|System Firmware|In the Ukraine 2015 Incident,

Sandworm Team developed and used malicious firmware to render communication devices inoperable. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Control Server,Input/Output Server|T0822|External Remote Services|In the Ukraine 2015 Incident,


Sandworm Team harvested VPN worker credentials and used them to remotely log into control system networks. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016) (Citation: Zetter, Kim March 2016) (Citation: ICS-CERT February 2016) (Citation: John Hultquist January 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED|T0816|Device Restart/Shutdown|In the 2015 attack on the Ukrainian power grid, the

Sandworm Team scheduled disconnects of uninterruptable power supply (UPS) systems so that when power was disconnected from the substations, the devices would shut down and service could not be recovered. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Engineering Workstation,Human-Machine Interface,Control Server,Data Historian|T0865|Spearphishing Attachment|In the Ukraine 2015 incident,

Sandworm Team sent spearphishing attachments to three energy distribution companies containing malware to gain access to victim systems. (Citation: UNITED STATES DISTRICT COURT WESTERN DISTRICT OF PENNSYLVANIA October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED,Input/Output Server,Device Configuration/Parameters|T0804|Block Reporting Message|In the Ukraine 2015 Incident,

Sandworm Team blocked reporting messages by using malicious firmware to render communication devices inoperable. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED,Device Configuration/Parameters|T0803|Block Command Message|In the Ukraine 2015 Incident,


Sandworm Team blocked command messages by using malicious firmware to render communication devices inoperable. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Human-Machine Interface|T0823|Graphical User Interface|In the Ukraine 2015 Incident,

Sandworm Team utilized HMI GUIs in the SCADA environment to open breakers. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Control Server,Data Historian,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server|T0807|Command-Line Interface|

Sandworm Team uses the MS-SQL server xp_cmdshell command, and PowerShell to execute commands. (Citation: Dragos October 2018)|


Scarlet Mimic - G0029

Created: 2017-05-31T21:32:00.677Z

Modified: 2020-03-30T19:16:53.144Z

Contributors:

Aliases

Scarlet Mimic

Description

Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by Scarlet Mimic and Putter Panda, it has not been concluded that the groups are the same. (Citation: Scarlet Mimic Jan 2016)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.002|Right-to-Left Override|Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.(Citation: Scarlet Mimic Jan 2016)|


SideCopy - G1008

Created: 2022-08-07T13:52:07.791Z

Modified: 2022-10-24T18:51:09.213Z

Contributors: Pooja Natarajan, NEC Corporation India,Hiroki Nagahama, NEC Corporation,Manikantan Srinivasan, NEC Corporation India

Aliases

SideCopy

Description

SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to mimic that of Sidewinder, a suspected Indian threat group.(Citation: MalwareBytes SideCopy Dec 2021)

Techniques Used

SideCopy has used compromised domains to host its malicious payloads.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

SideCopy has collected browser information from a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|PRE|T1598.002|Spearphishing Attachment|

SideCopy has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|PRE|T1584.001|Domains|

SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

SideCopy has identified the OS version of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,IaaS|T1614|System Location Discovery|


SideCopy has identified the country location of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

SideCopy has identified the IP address of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

SideCopy has utilized

SideCopy has executed malware by calling the API function

SideCopy has used a legitimate DLL file name,

SideCopy has used a malicious loader DLL file to execute the

SideCopy uses a loader DLL file to collect AV product names from an infected host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling

SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

SideCopy has sent spearphishing emails with malicious hta file attachments.(Citation: MalwareBytes SideCopy Dec 2021)|


Sidewinder - G0121

Created: 2021-01-27T15:57:11.183Z

Modified: 2023-03-22T05:31:54.382Z

Contributors: Lacework Labs,Daniyal Naeem, BT Security

Aliases

Sidewinder,T-APT-04,Rattlesnake

Description

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.(Citation: ATT Sidewinder January 2021)(Citation: Securelist APT Trends April 2018)(Citation: Cyble Sidewinder September 2020)

Techniques Used

Sidewinder has used base64 encoding for scripts.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Sidewinder has named malicious files

Sidewinder has lured targets to click on malicious links to gain execution in the target environment.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Sidewinder has used the Windows service

Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

Sidewinder has used


Sidewinder has used

Sidewinder has lured targets to click on malicious files to gain execution in the target environment.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Sidewinder has added paths to executables in the Registry to establish persistence.(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

Sidewinder has used tools to automatically collect system and network configuration information.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1020|Automated Exfiltration|

Sidewinder has configured tools to automatically send collected files to attacker controlled servers.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Sidewinder has used HTTP in C2 communications.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Sidewinder has used tools to enumerate software installed on an infected host.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|


Sidewinder has used malware to collect information on files and directories.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Sidewinder has used malware to collect information on network interfaces, including the MAC address.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Windows,Network|T1124|System Time Discovery|

Sidewinder has used tools to obtain the current system time.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Sidewinder has used tools to identify running processes on the victim's machine.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder COVID-19 June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Sidewinder has used tools to identify the user of a compromised host.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|


Sidewinder has used base64 encoding and ECDH-P256 encryption for payloads.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Sidewinder has used JavaScript to drop and execute malware loaders.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder COVID-19 June 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Sidewinder has used PowerShell to drop and execute malware loaders.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Sidewinder has used VBScript to drop and execute malware loaders.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Sidewinder has exploited vulnerabilities to gain execution including CVE-2017-11882 and CVE-2020-0674.(Citation: ATT Sidewinder January 2021)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Sidewinder has used LNK files to download remote files to the victim's network.(Citation: ATT Sidewinder January 2021)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|


Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Sidewinder has sent e-mails with malicious links often crafted for specific targets.(Citation: ATT Sidewinder January 2021)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|PRE|T1598.002|Spearphishing Attachment|

Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|PRE|T1598.003|Spearphishing Link|

Sidewinder has sent e-mails with malicious links to credential harvesting websites.(Citation: ATT Sidewinder January 2021)|


Silence - G0091

Created: 2019-05-24T17:57:36.491Z

Modified: 2023-03-22T05:34:46.346Z

Contributors: Oleg Skulkin, Group-IB

Aliases

Silence,Whisper Spider

Description

Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)

Techniques Used

Silence has obtained and modified versions of publicly-available tools like

Empire and

PsExec.(Citation: Group IB Silence Aug 2019) (Citation: SecureList Silence Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

Silence has used port 444 when sending data about the system from the client to the server.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|

Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1072|Software Deployment Tools|

Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Silence has used


Silence has used

Silence has downloaded additional modules and malware to victim’s machines.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Silence has used RDP for lateral movement.(Citation: Group IB Silence Sept 2018) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Silence has used the Farse6.1 utility (based on

Mimikatz) to extract credentials from lsass.exe.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

Silence can create, delete, or modify a specified Registry key or value.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Silence has named its backdoor "WINWORD.exe".(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Silence has used compromised credentials to log on to other systems and escalate privileges.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).(Citation: Group IB Silence Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|


Silence has used PowerShell to download and execute payloads.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Silence has used JS scripts.(Citation: Cyber Forensicator Silence Jan 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments. (Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Silence has used scheduled tasks to stage its operation.(Citation: Cyber Forensicator Silence Jan 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Silence has used VBS scripts.(Citation: Cyber Forensicator Silence Jan 2019)|
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

Silence has used

Winexe to install a service on the remote system.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Silence has used Windows command-line to run commands.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.001|Compiled HTML File|


Silence has weaponized CHM files in their phishing campaigns.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Aug 2019)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

Silence has used environment variable string substitution for obfuscation.(Citation: Cyber Forensicator Silence Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|

Silence can capture victim screen activity.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1125|Video Capture|

Silence has been observed making videos of victims to observe bank employees day to day activities.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|


Silent Librarian - G0122

Created: 2021-02-03T16:36:38.145Z

Modified: 2021-04-21T12:02:00.278Z

Contributors:

Aliases

Silent Librarian,TA407,COBALT DICKENS

Description

Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of  Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).(Citation: DOJ Iran Indictments March 2018)(Citation: Phish Labs Silent Librarian)(Citation: Malwarebytes Silent Librarian October 2020)

Techniques Used

Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns.

Silent Librarian has also made use of a variety of URL shorteners for these staged websites.(Citation: Secureworks COBALT DICKENS September 2019)(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.(Citation: Proofpoint TA407 September 2019)(Citation: Secureworks COBALT DICKENS September 2019)|
|mitre-attack|enterprise-attack|PRE|T1588.004|Digital Certificates|

Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.(Citation: Phish Labs Silent Librarian)(Citation: Secureworks COBALT DICKENS September 2019)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|


Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|Windows,Office 365,Google Workspace,macOS,Linux|T1114|Email Collection|

Silent Librarian has exfiltrated entire mailboxes from compromised accounts.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace,macOS,Linux|T1114.003|Email Forwarding Rule|

Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|PRE|T1589.003|Employee Names|

Silent Librarian has collected lists of names for individuals from targeted organizations.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1110.003|Password Spraying|

Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|


Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.(Citation: DOJ Iran Indictments March 2018)(Citation: Phish Labs Silent Librarian)(Citation: Secureworks COBALT DICKENS August 2018)(Citation: Proofpoint TA407 September 2019)(Citation: Secureworks COBALT DICKENS September 2019)(Citation: Malwarebytes Silent Librarian October 2020)|
|mitre-attack|enterprise-attack|PRE|T1594|Search Victim-Owned Websites|

Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.(Citation: DOJ Iran Indictments March 2018)(Citation: Phish Labs Silent Librarian)(Citation: Proofpoint TA407 September 2019)|
|mitre-attack|enterprise-attack|PRE|T1598.003|Spearphishing Link|

Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.(Citation: DOJ Iran Indictments March 2018)(Citation: Phish Labs Silent Librarian)(Citation: Secureworks COBALT DICKENS August 2018)(Citation: Proofpoint TA407 September 2019)(Citation: Secureworks COBALT DICKENS September 2019)(Citation: Malwarebytes Silent Librarian October 2020)|


SilverTerrier - G0083

Created: 2019-01-29T21:36:59.793Z

Modified: 2020-05-19T23:26:11.780Z

Contributors:

Aliases

SilverTerrier

Description

SilverTerrier is a Nigerian threat group that has been seen active since 2014. SilverTerrier mainly targets organizations in high technology, higher education, and manufacturing.(Citation: Unit42 SilverTerrier 2018)(Citation: Unit42 SilverTerrier 2016)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.002|File Transfer Protocols|SilverTerrier uses FTP for C2 communications.(Citation: Unit42 SilverTerrier 2018)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|SilverTerrier uses HTTP for C2 communications.(Citation: Unit42 SilverTerrier 2018)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.003|Mail Protocols|SilverTerrier uses SMTP for C2 communications.(Citation: Unit42 SilverTerrier 2018)|


Sowbug - G0054

Created: 2018-01-16T16:13:52.465Z

Modified: 2020-03-30T02:46:16.483Z

Contributors: Alan Neville, @abnev

Aliases

Sowbug

Description

Sowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015. (Citation: Symantec Sowbug Nov 2017)

Techniques Used

Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory

Sowbug has used command line during its intrusions.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

Sowbug extracted Word documents from a file server on a victim network.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

Sowbug listed remote shared drives that were accessible from a victim.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

Sowbug has used credential dumping tools.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Sowbug extracted documents and bundled them into a RAR archive.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Sowbug has used keylogging tools.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|


Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Sowbug obtained OS version and hardware configuration from a victim.(Citation: Symantec Sowbug Nov 2017)|


Stealth Falcon - G0038

Created: 2017-05-31T21:32:06.390Z

Modified: 2020-11-23T18:57:19.208Z

Contributors:

Aliases

Stealth Falcon

Description

Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. (Citation: Citizen Lab Stealth Falcon May 2016)

Techniques Used

Stealth Falcon malware gathers passwords from the Windows Credential Vault.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Stealth Falcon malware gathers a list of running processes.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Stealth Falcon malware gathers data from the local victim system.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|After data is collected by

Stealth Falcon malware, it is exfiltrated over the existing C2 channel.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|


Stealth Falcon malware uses WMI to script data collection and command execution on the victim.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Stealth Falcon malware communicates with its C2 server via HTTPS.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Stealth Falcon malware gathers the registered user and primary owner name via WMI.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|


Stealth Falcon malware gathers the Address Resolution Protocol (ARP) table from the victim.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|

Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.(Citation: Citizen Lab Stealth Falcon May 2016)|


Strider - G0041

Created: 2017-05-31T21:32:07.541Z

Modified: 2020-06-29T01:43:19.374Z

Contributors:

Aliases

Strider,ProjectSauron

Description

Strider is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda.(Citation: Symantec Strider Blog)(Citation: Kaspersky ProjectSauron Blog)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1564.005|Hidden File System|Strider has used a hidden file system that is stored as a file on disk.(Citation: Kaspersky ProjectSauron Full Report)|
|mitre-attack|enterprise-attack|Windows|T1556.002|Password Filter DLL|Strider has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.(Citation: Kaspersky ProjectSauron Full Report)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.001|Internal Proxy|Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.(Citation: Kaspersky ProjectSauron Blog)|


Suckfly - G0039

Created: 2017-05-31T21:32:06.777Z

Modified: 2022-04-15T16:27:38.682Z

Contributors:

Aliases

Suckfly

Description

Suckfly is a China-based threat group that has been active since at least 2014. (Citation: Symantec Suckfly March 2016)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.(Citation: Symantec Suckfly May 2016)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|Several tools used by Suckfly have been command-line driven.(Citation: Symantec Suckfly May 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|Suckfly used a signed credential-dumping tool to obtain victim account credentials.(Citation: Symantec Suckfly May 2016)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|Suckfly has used stolen certificates to sign its malware.(Citation: Symantec Suckfly March 2016)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.(Citation: Symantec Suckfly May 2016)|


TA459 - G0062

Created: 2018-04-18T17:59:24.739Z

Modified: 2020-03-30T19:22:32.962Z

Contributors: Valerii Marchuk, Cybersecurity Help s.r.o.

Aliases

TA459

Description

TA459 is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. (Citation: Proofpoint TA459 April 2017)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|TA459 has a VBScript for execution.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|TA459 has used PowerShell for execution of a payload.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.(Citation: Proofpoint TA459 April 2017)|


TA505 - G0092

Created: 2019-05-28T15:54:17.213Z

Modified: 2023-03-22T05:38:20.381Z

Contributors:

Aliases

TA505,Hive0065

Description

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: NCC Group TA505)(Citation: Korean FSI TA505 2020)

Techniques Used

TA505 has used base64 encoded PowerShell commands.(Citation: Cybereason TA505 April 2019)(Citation: Deep Instinct TA505 Apr 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

TA505 has used malware to disable Windows Defender.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

TA505 has staged malware on actor-controlled domains.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

TA505 has deployed payloads that use Windows API calls on a compromised host.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

TA505 has used malware such as

Azorult and

Cobalt Strike in their operations.(Citation: NCC Group TA505)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

TA505 has used a variety of tools in their operations, including

AdFind,

BloodHound,

Mimikatz, and


TA505 has used a variety of tools in their operations, including

AdFind,

BloodHound,

Mimikatz, and

PowerSploit.(Citation: NCC Group TA505)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

TA505 has decrypted packed DLLs with an XOR key.(Citation: NCC Group TA505)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

TA505 has used malware to disable Windows Defender through modification of the Registry.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

TA505 has registered domains to impersonate services such as Dropbox to distribute malware.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|Windows|T1553.005|Mark-of-the-Web Bypass|

TA505 has used .iso files to deploy malicious .lnk files.(Citation: TrendMicro TA505 Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1055.001|Dynamic-link Library Injection|

TA505 has been seen injecting a DLL into winword.exe.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

TA505 has used HTTP to communicate with C2 nodes.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

TA505 has used UPX to obscure malicious code.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

TA505 has used stolen domain admin accounts to compromise additional hosts.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1069|Permission Groups Discovery|


TA505 has used TinyMet to enumerate members of privileged groups.(Citation: IBM TA505 April 2020)

TA505 has also run

TA505 has used the tool EmailStealer to steal and send lists of e-mail addresses to a remote server.(Citation: Trend Micro TA505 June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1568.001|Fast Flux DNS|

TA505 has used fast flux to mask botnets by distributing payloads across multiple IPs.(Citation: Trend Micro TA505 June 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

TA505 has executed commands using

TA505 has used JavaScript for code execution.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

TA505 has used lures to get users to click links in emails and attachments. For example,

TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files. (Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: Cybereason TA505 April 2019)(Citation: ProofPoint SettingContent-ms July 2018)(Citation: Proofpoint TA505 Mar 2018)(Citation: Trend Micro TA505 June 2019)(Citation: Proofpoint TA505 October 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

TA505 has used malware to gather credentials from Internet Explorer.(Citation: Proofpoint TA505 Sep 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|


TA505 has downloaded additional malware to execute on victim systems.(Citation: Cybereason TA505 April 2019)(Citation: Deep Instinct TA505 Apr 2019)(Citation: ProofPoint SettingContent-ms July 2018)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

TA505 has signed payloads with code signing certificates from Thawte and Sectigo.(Citation: Cybereason TA505 April 2019)(Citation: Deep Instinct TA505 Apr 2019)(Citation: Trend Micro TA505 June 2019)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

TA505 has leveraged

TA505 has used

TA505 has used lures to get users to enable content in malicious attachments and execute malicious files contained in archives. For example,

TA505 makes their malware look like legitimate Microsoft Word documents, .pdf and/or .lnk files. (Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: Cybereason TA505 April 2019)(Citation: ProofPoint SettingContent-ms July 2018)(Citation: Proofpoint TA505 Mar 2018)(Citation: Trend Micro TA505 June 2019)(Citation: Proofpoint TA505 October 2019)(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

TA505 has password-protected malicious Word documents.(Citation: Proofpoint TA505 Sep 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|

TA505 has used malware to gather credentials from FTP clients and Outlook.(Citation: Proofpoint TA505 Sep 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS|T1486|Data Encrypted for Impact|

TA505 has used a wide variety of ransomware, such as


TA505 has used a wide variety of ransomware, such as

Clop, Locky, Jaff, Bart, Philadelphia, and GlobeImposter, to encrypt victim files and demand a ransom payment.(Citation: Proofpoint TA505 Sep 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

TA505 has used VBS for code execution.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Trend Micro TA505 June 2019)(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

TA505 has used PowerShell to download and execute malware and reconnaissance scripts.(Citation: Proofpoint TA505 Sep 2017)(Citation: ProofPoint SettingContent-ms July 2018)(Citation: Cybereason TA505 April 2019)(Citation: Deep Instinct TA505 Apr 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

TA505 has sent spearphishing emails containing malicious links.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 Jan 2019)(Citation: Trend Micro TA505 June 2019)(Citation: Proofpoint TA505 October 2019)|
|mitre-attack|enterprise-attack|Windows|T1559.002|Dynamic Data Exchange|

TA505 has leveraged malicious Word documents that abused DDE.(Citation: Proofpoint TA505 June 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|


TA505 has used spearphishing emails with malicious attachments to initially compromise victims.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: Cybereason TA505 April 2019)(Citation: ProofPoint SettingContent-ms July 2018)(Citation: Proofpoint TA505 Mar 2018)(Citation: Trend Micro TA505 June 2019)(Citation: Proofpoint TA505 October 2019)(Citation: IBM TA505 April 2020)|


TA551 - G0127

Created: 2021-03-19T21:04:00.692Z

Modified: 2023-03-22T05:40:21.255Z

Contributors: Shuhei Sasada, Cyber Defense Institute, Inc,Ryo Tamura, SecureBrain Corporation,Shotaro Hamamoto, NEC Solution Innovators, Ltd,Yusuke Niwa, ITOCHU Corporation,Takuma Matsumoto, LAC Co., Ltd

Aliases

TA551,GOLD CABIN,Shathak

Description

TA551 is a financially-motivated threat group that has been active since at least 2018. (Citation: Secureworks GOLD CABIN) The group has primarily targeted English, German, Italian, and Japanese speakers through email-based malware distribution campaigns. (Citation: Unit 42 TA551 Jan 2021)

Techniques Used

TA551 has used mshta.exe to execute malicious payloads.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

TA551 has prompted users to enable macros within spearphishing attachments to install malware.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

TA551 has sent spearphishing attachments with password protected ZIP files.(Citation: Unit 42 Valak July 2020)(Citation: Unit 42 TA551 Jan 2021)(Citation: Secureworks GOLD CABIN)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

TA551 has used

TA551 has used a DGA to generate URLs from executed macros.(Citation: Unit 42 TA551 Jan 2021)(Citation: Secureworks GOLD CABIN)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|