APT32 has used PubPrn.vbs within execution scripts to execute malware, possibly bypassing defenses.(Citation: Twitter ItsReallyNick Status Update APT32 PubPrn)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

APT32 has used Web shells to maintain access to victim websites.(Citation: Volexity OceanLotus Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT32 has added JavaScript to victim websites to download additional frameworks that profile and compromise website visitors.(Citation: Volexity OceanLotus Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT32 has used JavaScript that communicates over HTTP or HTTPS to attacker controlled domains to download additional frameworks. The group has also used downloaded encrypted payloads over HTTP.(Citation: Volexity OceanLotus Nov 2017)(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT32 has performed code obfuscation, including encoding payloads using Base64 and using a framework called "Dont-Kill-My-Cat (DKMC).

APT32 also encrypts the library used for network exfiltration with AES-256 in CBC mode in their macOS backdoor.(Citation: FireEye APT32 May 2017)(Citation: GitHub Invoke-Obfuscation)(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: ESET OceanLotus macOS April 2019)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|


APT32 has used scheduled tasks to persist on victim systems.(Citation: FireEye APT32 May 2017)(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1072|Software Deployment Tools|

APT32 compromised McAfee ePO to move laterally by distributing malware as a software deployment task.(Citation: FireEye APT32 May 2017)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

APT32 created a

Scheduled Task/Job that used regsvr32.exe to execute a COM scriptlet that dynamically downloaded a backdoor and injected it into memory. The group has also used regsvr32 to run their backdoor.(Citation: ESET OceanLotus Mar 2019)(Citation: FireEye APT32 May 2017)(Citation: Cybereason Cobalt Kitty 2017) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

APT32 has also renamed a Cobalt Strike beacon payload to install_flashplayers.exe. (Citation: Cybereason Cobalt Kitty 2017)(Citation: Volexity Ocean Lotus November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

APT32 has used CVE-2016-7255 to escalate privileges.(Citation: FireEye APT32 May 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.006|Timestomp|

APT32 has used scheduled task raw XML with a backdated timestamp of June 2, 2016. The group has also set the creation time of the files dropped by the second stage of the exploit to match the creation time of kernel32.dll. Additionally,


APT32 has used a random value to modify the timestamp of the file storing the clientID.(Citation: FireEye APT32 May 2017)(Citation: ESET OceanLotus Mar 2019)(Citation: ESET OceanLotus macOS April 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

APT32 has used legitimate local admin account credentials.(Citation: FireEye APT32 May 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

APT32 has used PowerShell-based tools, PowerShell one-liners, and shellcode loaders for execution.(Citation: FireEye APT32 May 2017)(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)|


APT33 - G0064

Created: 2018-04-18T17:59:24.739Z

Modified: 2023-03-08T22:07:25.123Z

Contributors: Dragos  Threat  Intelligence

Aliases

APT33,HOLMIUM,Elfin

Description

APT33 is a suspected Iranian threat group that has carried out operations since at least 2013. The group has targeted organizations across multiple industries in the United States, Saudi Arabia, and South Korea, with a particular interest in the aviation and energy sectors. (Citation: FireEye APT33 Sept 2017) (Citation: FireEye APT33 Webinar Sept 2017)

Techniques Used

APT33 has obtained and leveraged publicly-available tools for early intrusion activities.(Citation: FireEye APT33 Guardrail)(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

APT33 has attempted to use WMI event subscriptions to establish persistence on compromised hosts.(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT33 has sent spearphishing e-mails with archive attachments.(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|

APT33 has used malicious e-mail attachments to lure victims into executing malware.(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

APT33 has used VBScript to initiate the delivery of payloads.(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Azure AD,Office 365,SaaS,IaaS,Google Workspace|T1078.004|Cloud Accounts|

APT33 has used compromised Office 365 accounts in tandem with


APT33 has used compromised Office 365 accounts in tandem with

Ruler in an attempt to gain control of endpoints.(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

APT33 has used HTTP over TCP ports 808 and 880 for command and control.(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1552.006|Group Policy Preferences|

APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

APT33 has used a variety of publicly available tools like

LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

APT33 has used a variety of publicly available tools like

LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.005|Cached Domain Credentials|

APT33 has used a variety of publicly available tools like

LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.004|LSA Secrets|

APT33 has used a variety of publicly available tools like

LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|


APT33 has used a variety of publicly available tools like

LaZagne to gather credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1110.003|Password Spraying|

APT33 has used password spraying to gain access to target systems.(Citation: FireEye APT33 Guardrail)(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

APT33 has used a publicly available exploit for CVE-2017-0213 to escalate privileges on a local system.(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

APT33 has used AES for encryption of command and control traffic.(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT33 has used base64 to encode payloads.(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

APT33 has used base64 to encode command and control traffic.(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

APT33 has created a scheduled task to execute a .vbe file multiple times a day.(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1048.003|Exfiltration Over Unencrypted Non-C2 Protocol|


APT33 has used FTP to exfiltrate files (separately from the C2 channel).(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT33 has used HTTP for command and control.(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT33 has deployed a tool known as

DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.(Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|

APT33 has utilized PowerShell to download files from the C2 server and run various scripts. (Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT33 has downloaded additional files and programs from its C2 server.(Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)

APT33 has used WinRAR to compress data prior to exfil.(Citation: Symantec Elfin Mar 2019)
|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.001|LSASS Memory|

APT33 has used a variety of publicly available tools like

LaZagne,

Mimikatz, and ProcDump to dump credentials.(Citation: Symantec Elfin Mar 2019)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network,IaaS|T1040|Network Sniffing|


APT33 has used SniffPass to collect credentials by sniffing network traffic.(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).(Citation: Symantec Elfin Mar 2019)(Citation: Microsoft Holmium June 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.(Citation: FireEye APT33 Sept 2017)(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

APT33 has used valid accounts for initial access and privilege escalation.(Citation: FireEye APT33 Webinar Sept 2017)(Citation: FireEye APT33 Guardrail)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

APT33 has sent spearphishing emails containing links to .hta files.(Citation: FireEye APT33 Sept 2017)(Citation: Symantec Elfin Mar 2019)|
|mitre-attack|enterprise-attack,ics-attack|Engineering Workstation|T0853|Scripting|

APT33 utilized PowerShell scripts to establish command and control and install files for execution. (Citation: Symantec March 2019) (Citation: Dragos)|
|mitre-attack|enterprise-attack,ics-attack|Human-Machine Interface|T0852|Screen Capture|


APT33 utilize backdoors capable of capturing screenshots once installed on a system. (Citation: Jacqueline O'Leary et al. September 2017)(Citation: Junnosuke Yagi March 2017)|
|mitre-attack|enterprise-attack,ics-attack|Engineering Workstation,Human-Machine Interface,Control Server,Data Historian|T0865|Spearphishing Attachment|

APT33 sent spear phishing emails containing links to HTML application files, which were embedded with malicious code. (Citation: Jacqueline O'Leary et al. September 2017)

APT33 has conducted targeted spear phishing campaigns against U.S. government agencies and private sector companies. (Citation: Andy Greenburg June 2019)|


APT37 - G0067

Created: 2018-04-18T17:59:24.739Z

Modified: 2021-10-15T16:54:01.193Z

Contributors: Valerii Marchuk, Cybersecurity Help s.r.o.

Aliases

APT37,Richochet Chollima,InkySquid,ScarCruft,Reaper,Group123,TEMP.Reaper

Description

APT37 is a North Korean state-sponsored cyber espionage group that has been active since at least 2012. The group has targeted victims primarily in South Korea, but also in Japan, Vietnam, Russia, Nepal, China, India, Romania, Kuwait, and other parts of the Middle East. APT37 has also been linked to the following campaigns between 2016-2018: Operation Daybreak, Operation Erebus, Golden Time, Evil New Year, Are you Happy?, FreeMilk, North Korean Human Rights, and Evil New Year 2018.(Citation: FireEye APT37 Feb 2018)(Citation: Securelist ScarCruft Jun 2016)(Citation: Talos Group123)

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Techniques Used

APT37 has used Ruby scripts to execute payloads.(Citation: Volexity InkySquid RokRAT August 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

APT37 has used Python scripts to execute payloads.(Citation: Volexity InkySquid RokRAT August 2021)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

APT37 has created scheduled tasks to run malicious scripts on a compromised host.(Citation: Volexity InkySquid RokRAT August 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|


APT37 executes shellcode and a VBA script to decode Base64 strings.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

APT37 uses steganography to send images to users that are embedded with shellcode.(Citation: Talos Group123)(Citation: Securelist ScarCruft May 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1529|System Shutdown/Reboot|

APT37 has used malware that will issue the command

APT37 has a function in the initial dropper to bypass Windows UAC in order to execute the next payload with higher privileges.(Citation: Securelist ScarCruft May 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1120|Peripheral Device Discovery|

APT37 has a Bluetooth device harvester, which uses Windows Bluetooth APIs to find information on connected Bluetooth devices. (Citation: Securelist ScarCruft May 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

APT37 leverages the Windows API calls: VirtualAlloc(), WriteProcessMemory(), and CreateRemoteThread() for process injection.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

APT37 injects its malware variant,

ROKRAT, into the cmd.exe process.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

APT37 identifies the victim username.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT37 uses HTTPS to conceal C2 communications.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|


APT37 uses HTTPS to conceal C2 communications.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

APT37 collects the computer name, the BIOS model, and execution path.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

APT37's Freenki malware lists running processes using the Microsoft Windows API.(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT37 obfuscates strings and payloads.(Citation: Talos Group123)(Citation: Securelist ScarCruft May 2019)(Citation: Volexity InkySquid RokRAT August 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

APT37 leverages social networking sites and cloud platforms (AOL, Twitter, Yandex, Mediafire, pCloud, Dropbox, and Box) for C2.(Citation: FireEye APT37 Feb 2018)(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT37 delivers malware using spearphishing emails with malicious HWP attachments.(Citation: FireEye APT37 Feb 2018)(Citation: Talos Group123)(Citation: Securelist ScarCruft May 2019)|
|mitre-attack|enterprise-attack|Windows|T1559.002|Dynamic Data Exchange|

APT37 has used Windows DDE for execution of commands and a malicious VBS.(Citation: Securelist ScarCruft Jun 2016)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|


APT37 has used the command-line interface.(Citation: FireEye APT37 Feb 2018)(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

APT37 has used exploits for Flash Player (CVE-2016-4117, CVE-2018-4878), Word (CVE-2017-0199), Internet Explorer (CVE-2020-1380 and CVE-2020-26411), and Microsoft Edge (CVE-2021-26411) for execution.(Citation: Securelist ScarCruft Jun 2016)(Citation: FireEye APT37 Feb 2018)(Citation: Talos Group123)(Citation: Volexity InkySquid BLUELIGHT August 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

APT37 has used a credential stealer known as ZUMKONG that can harvest usernames and passwords stored in browsers.(Citation: FireEye APT37 Feb 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

APT37 has sent spearphishing attachments attempting to get a user to open them.(Citation: FireEye APT37 Feb 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1561.002|Disk Structure Wipe|

APT37 has access to destructive malware that is capable of overwriting a machine's Master Boot Record (MBR).(Citation: FireEye APT37 Feb 2018)(Citation: Talos Group123)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|


APT37 has used strategic web compromises, particularly of South Korean websites, to distribute malware. The group has also used torrent file-sharing sites to more indiscriminately disseminate malware to victims. As part of their compromises, the group has used a Javascript based profiler called RICECURRY to profile a victim's web browser and deliver malicious code accordingly.(Citation: Securelist ScarCruft Jun 2016)(Citation: FireEye APT37 Feb 2018)(Citation: Volexity InkySquid BLUELIGHT August 2021)|
|mitre-attack|enterprise-attack|macOS,Windows|T1036.001|Invalid Code Signature|

APT37 has signed its malware with an invalid digital certificates listed as “Tencent Technology (Shenzhen) Company Limited.”(Citation: Securelist ScarCruft Jun 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

APT37 has collected data from victims' local systems.(Citation: FireEye APT37 Feb 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1123|Audio Capture|

APT37 has used an audio capturing utility known as SOUNDWAVE that captures microphone input.(Citation: FireEye APT37 Feb 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT37 has downloaded second stage malware from compromised websites.(Citation: FireEye APT37 Feb 2018)(Citation: Securelist ScarCruft May 2019)(Citation: Volexity InkySquid BLUELIGHT August 2021)(Citation: Volexity InkySquid RokRAT August 2021)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT37's has added persistence via the Registry key


APT38 - G0082

Created: 2019-01-29T21:27:24.793Z

Modified: 2022-01-18T17:13:14.610Z

Contributors:

Aliases

APT38,NICKEL GLADSTONE,BeagleBoyz,Bluenoroff,Stardust Chollima

Description

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext (2018) and Banco de Chile (2018); some of their attacks have been destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Techniques Used

APT38 has used CHM files to move concealed payloads.(Citation: Kaspersky Lazarus Under The Hood APR 2017)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1588.002|Tool|

APT38 has obtained and used open-source tools such as

Mimikatz.(Citation: ESET Lazarus KillDisk April 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.006|Timestomp|


APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

APT38 has enumerated network shares on a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1543.003|Windows Service|

APT38 has installed a new Windows service to establish persistence.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|


APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1562.003|Impair Command History Logging|

APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

APT38 has used web shells for persistence or to ensure redundant access.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

APT38 have enumerated files and directories, or searched in specific locations within a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1217|Browser Information Discovery|

APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1562.004|Disable or Modify System Firewall|

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|


APT38 has collected data from a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1569.002|Service Execution|

APT38 has created new services or modified existing ones to run executables, commands, or scripts.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1106|Native API|

APT38 has used the Windows API to execute code within a victim's system.(Citation: CISA AA20-239A BeagleBoyz August 2020) |
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

APT38 has used VBScript to execute commands and other operational tasks.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|

APT38 has used PowerShell to execute commands and other operational tasks.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1218.011|Rundll32|

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|


APT38  has attempted to lure victims into enabling malicious macros within email attachments.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS|T1053.003|Cron|

APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT38 has conducted spearphishing campaigns using malicious email attachments.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1529|System Shutdown/Reboot|

APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS|T1485|Data Destruction|

APT38 has used a custom secure delete function to make deleted files unrecoverable.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,IaaS|T1486|Data Encrypted for Impact|

APT38 has used Hermes ransomware to encrypt files with AES256.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1561.002|Disk Structure Wipe|


APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1565.001|Stored Data Manipulation|

APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1565.002|Transmitted Data Manipulation|

APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1565.003|Runtime Data Manipulation|

APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

APT38 has conducted watering holes schemes to gain initial access to victims.(Citation: FireEye APT38 Oct 2018)(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.003|Windows Command Shell|


APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1115|Clipboard Data|

APT38 used a Trojan called KEYLIME to collect data from the clipboard.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1112|Modify Registry|

APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1070.001|Clear Windows Event Logs|

APT38 clears Window Event logs and Sysmon logs from the system.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.(Citation: FireEye APT38 Oct 2018)(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

APT38 leveraged Sysmon to understand the processes, services in the organization.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1027.002|Software Packing|


APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.(Citation: FireEye APT38 Oct 2018)|


APT39 - G0087

Created: 2019-02-19T16:01:38.585Z

Modified: 2022-09-02T18:03:29.024Z

Contributors:

Aliases

APT39,ITG07,Chafer,Remix Kitten

Description

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)

Techniques Used

APT39 has modified and used customized versions of publicly-available tools like PLINK and

Mimikatz.(Citation: BitDefender Chafer May 2020)(Citation: IBM ITG07 June 2019)|
|mitre-attack|enterprise-attack|Windows|T1546.010|AppInit DLLs|

APT39 has used malware to set

APT39 has used malware to decrypt encrypted CAB files.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,macOS|T1553.006|Code Signing Policy Modification|

APT39 has used malware to turn off the

APT39 has used malware to delete files after they are deployed on a compromised host.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT39 has used malware to drop encrypted CAB files.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|


APT39 has exfiltrated stolen victim data through C2 communications.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

APT39 has utilized tools to aggregate data prior to exfiltration.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows|T1197|BITS Jobs|

APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

APT39 has used tools with the ability to search for files on a compromised host.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|

APT39 has used various strains of malware to query the Registry.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1056|Input Capture|

APT39 has utilized tools to capture mouse movements.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

APT39 has utilized malicious VBS scripts in malware.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.(Citation: BitDefender Chafer May 2020)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|


APT39 has used SQL injection for initial compromise.(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|

APT39 has used a screen capture utility to take screenshots on a compromised host.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

APT39 has used tools for capturing keystrokes.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

APT39 has used various tools to steal files from the compromised host.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1115|Clipboard Data|

APT39 has used tools capable of stealing contents of the clipboard.(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT39 has downloaded tools to compromised hosts.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

APT39 has used SMB for lateral movement.(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

APT39 has used different versions of Mimikatz to obtain credentials.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|


APT39 has used HTTP in communications with C2.(Citation: BitDefender Chafer May 2020)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

APT39 has used a command line utility and a network scanner written in python.(Citation: BitDefender Chafer May 2020)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.004|DNS|

APT39 has used remote access tools that leverage DNS in communications with C2.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

APT39 has used PowerShell to execute malicious code.(Citation: BitDefender Chafer May 2020)(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

APT39 has used the post exploitation tool

CrackMapExec to enumerate network shares.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.(Citation: BitDefender Chafer May 2020)(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

APT39 has created accounts on multiple compromised hosts to perform actions within the network.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|


APT39 has used various tools to proxy C2 communications.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

APT39 has used Ncrack to reveal credentials.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.(Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

APT39 used

Remexi to collect usernames from the system.(Citation: Symantec Chafer Dec 2015)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

APT39 has packed tools with UPX, and has repacked a modified version of

Mimikatz to thwart anti-virus detection.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|


APT39 has installed ANTAK and ASPXSPY web shells.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

APT39 used secure shell (SSH) to move laterally among their targets.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

APT39 has used stolen credentials to compromise Outlook Web Access (OWA).(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

APT39 has utilized AutoIt and custom scripts to perform internal reconnaissance.(Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

APT39 has used

CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.001|Internal Proxy|

APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|


APT39 has used WinRAR and 7-Zip to compress an archive stolen data.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

APT39 has used

NBTscan and custom tools to discover remote systems.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.009|Shortcut Modification|

APT39 has modified LNK shortcuts.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

APT39 has created scheduled tasks for persistence.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT39 has maintained persistence using the startup folder.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

APT39 leveraged spearphishing emails with malicious links to initially compromise victims.(Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|


APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|


APT41 - G0096

Created: 2019-09-23T13:43:36.945Z

Modified: 2023-03-23T15:45:58.846Z

Contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet

Aliases

APT41,Wicked Panda

Description

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting healthcare, telecom, technology, and video game industries in 14 countries. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)

Techniques Used

APT41 has added user accounts to the User and Admin groups.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

APT41 has obtained and used tools such as

Mimikatz,

pwdump,

PowerSploit, and

Windows Credential Editor.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

APT41 has uploaded files and data from a compromised host.(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

APT41 has created services to appear as benign system tools.(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

APT41 has used rundll32.exe to execute a loader.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|


APT41 has used search order hijacking to execute malicious payloads, such as Winnti RAT.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

APT41 has transferred implant files using Windows Admin Shares.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Linux,macOS|T1574.006|Dynamic Linker Hijacking|

APT41 has configured payloads to load via LD_PRELOAD.(Citation: Crowdstrike GTR2020 Mar 2020)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1480.001|Environmental Keying|

APT41 has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines.

APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.(Citation: Twitter ItsReallyNick APT41 EK)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.(Citation: FireEye APT41 March 2020) |
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

APT41 used  svchost.exe and

Net to execute a system service installed to launch a

Cobalt Strike BEACON loader.(Citation: FireEye APT41 March 2020)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|macOS,Linux|T1059.004|Unix Shell|

APT41 executed

APT41 has executed

APT41 used exploit payloads that initiate download via

ftp.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|


ftp.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Windows|T1197|BITS Jobs|

APT41 used

BITSAdmin to download and install payloads.(Citation: FireEye APT41 March 2020)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1104|Multi-Stage Channels|

APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT41 used

certutil to download additional files.(Citation: FireEye APT41 March 2020)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT41 used VMProtected binaries in multiple intrusions.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

APT41 used the

APT41 has enumerated IP addresses of network resources and used the

APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|


APT41 used legitimate executables to perform DLL side-loading of their malware.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT41 deleted files from the system.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1218.001|Compiled HTML File|

APT41 used compiled HTML (.chm) files for targeting.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1008|Fallback Channels|

APT41 used the Steam community page as a fallback mechanism for C2.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.004|DNS|

APT41 used DNS for C2 communications.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

APT41 collected MAC addresses from victim machines.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

APT41 has created user accounts.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|


APT41 has created user accounts.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

APT41 used a compromised account to create a scheduled task on a system.(Citation: FireEye APT41 Aug 2019)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

APT41 modified legitimate Windows services to install malware backdoors.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)

APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1070.003|Clear Command History|

APT41 attempted to remove evidence of some of its activity by deleting Bash histories.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

APT41 used

APT41 used a batch file to install persistence for the

Cobalt Strike BEACON loader.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS|T1486|Data Encrypted for Impact|

APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.001|Dead Drop Resolver|

APT41 used legitimate websites for C2 through dead drop resolvers (DDR), including GitHub, Pastebin, and Microsoft TechNet.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1496|Resource Hijacking|


APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

APT41 created a RAR archive of targeted files for exfiltration.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1070.001|Clear Windows Event Logs|

APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT41 created and modified startup files for persistence.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)

APT41 added a registry key in

APT41 used the WMIEXEC utility to execute

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via

PowerSploit.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

APT41 used compromised credentials to log on to other systems.(Citation: FireEye APT41 Aug 2019)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|


APT41 used a keylogger called GEARSHIFT on a target system.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1195.002|Compromise Software Supply Chain|

APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1568.002|Domain Generation Algorithms|

APT41 has used DGAs to change their C2 servers monthly.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

APT41 used a tool called CLASSFON to covertly proxy network communications.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.(Citation: FireEye APT41 Aug 2019)
|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

APT41 attempted to masquerade their files as popular anti-virus software.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|


APT41 leveraged PowerShell to deploy malware families in victims’ environments.(Citation: FireEye APT41 Aug 2019)(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

APT41 leveraged sticky keys to establish persistence.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

APT41 has used hashdump,

Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

APT41 used RDP for lateral movement.(Citation: FireEye APT41 Aug 2019)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,Azure AD,Network|T1110.002|Password Cracking|

APT41 performed password brute-force attacks on the local admin account.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,Windows|T1542.003|Bootkit|

APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1014|Rootkit|


APT41 deployed rootkits on Linux systems.(Citation: FireEye APT41 Aug 2019)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|


Aquatic Panda - G0143

Created: 2022-01-18T14:49:29.505Z

Modified: 2023-03-21T21:16:34.243Z

Contributors: NST Assure Research Team, NetSentries Technologies,Pooja Natarajan, NEC Corporation India,Hiroki Nagahama, NEC Corporation,Manikantan Srinivasan, NEC Corporation India

Aliases

Aquatic Panda

Description

Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.(Citation: CrowdStrike AQUATIC PANDA December 2021)

Techniques Used

Aquatic Panda has acquired and used

Cobalt Strike in its operations.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

Aquatic Panda has acquired and used

njRAT in its operations.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Aquatic Panda has used DLL search-order hijacking to load

Aquatic Panda has encoded PowerShell commands in Base64.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Aquatic Panda has used native OS commands to understand privilege levels and system details.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Aquatic Panda has attempted to discover services for third party EDR products.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to


Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to

Aquatic Panda has used WinRAR to compress memory dumps prior to exfiltration.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Aquatic Panda has deleted malicious executables from compromised machines.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Aquatic Panda has downloaded additional malware onto compromised hosts.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|

Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.(Citation: CrowdStrike AQUATIC PANDA December 2021)|


Axiom - G0001

Created: 2017-05-31T21:31:45.629Z

Modified: 2023-03-20T22:03:44.661Z

Contributors:

Aliases

Axiom,Group 72

Description

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015)

Techniques Used

Axiom has collected data from a compromised network.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1583.002|DNS Server|

Axiom has acquired dynamic DNS services for use in the targeting of intended victims.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1583.003|Virtual Private Server|

Axiom has used VPS hosting providers in targeting of intended victims.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

Axiom has compressed and encrypted data prior to exfiltration.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows|T1563.002|RDP Hijacking|

Axiom has targeted victims with remote administration tools including RDP.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Axiom has used previously compromised administrative accounts to escalate privileges.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1584.005|Botnet|


Axiom has used previously compromised administrative accounts to escalate privileges.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1584.005|Botnet|

Axiom has used large groups of compromised machines for use as proxy nodes.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1553|Subvert Trust Controls|

Axiom has used digital certificates to deliver malware.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Axiom has used watering hole attacks to gain access.(Citation: Cisco Group 72)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,SaaS,Office 365,Google Workspace|T1566|Phishing|

Axiom has used spear phishing to initially compromise victims.(Citation: Cisco Group 72)(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.(Citation: Cisco Group 72)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1001.002|Steganography|

Axiom has used steganography to hide its C2 communications.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Axiom has been observed using SQL injection to gain access to systems.(Citation: Novetta-Axiom)(Citation: Cisco Group 72)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|


Axiom has been known to dump credentials.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Axiom has used RDP during operations.(Citation: Novetta-Axiom)|


BackdoorDiplomacy - G0135

Created: 2021-09-21T14:52:49.596Z

Modified: 2021-10-18T19:47:11.389Z

Contributors: Zaw Min Htun, @Z3TAE

Aliases

BackdoorDiplomacy

Description

BackdoorDiplomacy is a cyber espionage threat group that has been active since at least 2017. BackdoorDiplomacy has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe, the Middle East, and Asia.(Citation: ESET BackdoorDiplomacy Jun 2021)

Techniques Used

BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|


BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor.

BackdoorDiplomacy has also exploited mis-configured Plesk servers.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

BackdoorDiplomacy has used NetCat and PortQry  to enumerate network connections and display the status of related TCP and UDP ports.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

BackdoorDiplomacy has dropped implants in folders named for legitimate software.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|


BackdoorDiplomacy has executed DLL search order hijacking.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows|T1055.001|Dynamic-link Library Injection|

BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.(Citation: ESET BackdoorDiplomacy Jun 2021)|


BITTER - G1002

Created: 2022-06-01T20:26:53.880Z

Modified: 2022-06-01T21:20:18.113Z

Contributors:

Aliases

BITTER,T-APT-17

Description

BITTER is a suspected South Asian cyber espionage threat group that has been active since at least 2013. BITTER has primarily targeted government, energy, and engineering organizations in Pakistan, China, Bangladesh, and Saudi Arabia.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)

Techniques Used

BITTER has registered domains to stage payloads.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

BITTER has registered a variety of domains to host malicious payloads and for C2.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

BITTER has exploited CVE-2021-1732 for privilege escalation.(Citation: DBAPPSecurity BITTER zero-day Feb 2021)(Citation: Microsoft CVE-2021-1732 Feb 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

BITTER has obtained tools such as PuTTY for use in their operations.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1568|Dynamic Resolution|

BITTER has used DDNS for C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1573|Encrypted Channel|

BITTER has encrypted their C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|


BITTER has used TCP for C2 communications.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

BITTER has used HTTP POST requests for C2.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

BITTER has used a RAR SFX dropper to deliver malware.(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

BITTER has used scheduled tasks for persistence and execution.(Citation: Cisco Talos Bitter Bangladesh May 2022)|
|mitre-attack|enterprise-attack|Windows|T1559.002|Dynamic Data Exchange|

BITTER has executed OLE objects using Microsoft Equation Editor to download and run malicious payloads.(Citation: Cisco Talos Bitter Bangladesh May 2022) |
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

BITTER has disguised malware as a Windows Security update service.(Citation: Cisco Talos Bitter Bangladesh May 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

BITTER has downloaded additional malware and tools onto a compromised host.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016) |
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|


BITTER has exploited Microsoft Office vulnerabilities CVE-2012-0158, CVE-2017-11882, CVE-2018-0798, and CVE-2018-0802.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

BITTER has attempted to lure victims into opening malicious attachments delivered via spearphishing.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

BITTER has sent spearphishing emails with a malicious RTF document or Excel spreadsheet.(Citation: Cisco Talos Bitter Bangladesh May 2022)(Citation: Forcepoint BITTER Pakistan Oct 2016)|


BlackOasis - G0063

Created: 2018-04-18T17:59:24.739Z

Modified: 2018-10-17T00:14:20.652Z

Contributors:

Aliases

BlackOasis

Description

BlackOasis is a Middle Eastern threat group that is believed to be a customer of Gamma Group. The group has shown interest in prominent figures in the United Nations, as well as opposition bloggers, activists, regional news correspondents, and think tanks. (Citation: Securelist BlackOasis Oct 2017) (Citation: Securelist APT Trends Q2 2017) A group known by Microsoft as NEODYMIUM is reportedly associated closely with BlackOasis operations, but evidence that the group names are aliases has not been identified. (Citation: CyberScoop BlackOasis Oct 2017)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|BlackOasis's first stage shellcode contains a NOP sled with alternative instructions that was likely designed to bypass antivirus tools.(Citation: Securelist BlackOasis Oct 2017)|


BlackTech - G0098

Created: 2020-05-05T18:36:45.970Z

Modified: 2022-04-06T13:14:27.477Z

Contributors: Tatsuya Daitoku, Cyber Defense Institute, Inc.,Hannah Simes, BT Security

Aliases

BlackTech,Palmerworm

Description

BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.(Citation: TrendMicro BlackTech June 2017)(Citation: Symantec Palmerworm Sep 2020)(Citation: Reuters Taiwan BlackTech August 2020)

Techniques Used

BlackTech has obtained and used tools such as Putty, SNScan, and

PsExec for its operations.(Citation: Symantec Palmerworm Sep 2020)|
|mitre-attack|enterprise-attack|PRE|T1588.004|Digital Certificates|

BlackTech has used valid, stolen digital certificates for some of their malware and tools.(Citation: ESET PLEAD Malware July 2018)|
|mitre-attack|enterprise-attack|PRE|T1588.003|Code Signing Certificates|

BlackTech has used stolen code-signing certificates for its malicious payloads.(Citation: Symantec Palmerworm Sep 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

BlackTech has used the SNScan tool to find other potential targets on victim networks.(Citation: Symantec Palmerworm Sep 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

BlackTech has used built-in API functions.(Citation: IronNet BlackTech Oct 2021)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|


BlackTech has used built-in API functions.(Citation: IronNet BlackTech Oct 2021)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

BlackTech has used Putty for remote access.(Citation: Symantec Palmerworm Sep 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

BlackTech has used DLL side loading by giving DLLs hardcoded names and placing them in searched directories.(Citation: Trend Micro Waterbear December 2019) |
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

BlackTech has used spearphishing e-mails with malicious password-protected archived files (ZIP or RAR) to deliver malware.(Citation: TrendMicro BlackTech June 2017)(Citation: NTT Security Flagpro new December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

BlackTech has used e-mails with malicious documents to lure victims into installing malware.(Citation: TrendMicro BlackTech June 2017)(Citation: NTT Security Flagpro new December 2021)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

BlackTech has used spearphishing e-mails with links to cloud services to deliver malware.(Citation: TrendMicro BlackTech June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

BlackTech has used e-mails with malicious links to lure victims into installing malware.(Citation: TrendMicro BlackTech June 2017)     |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.002|Right-to-Left Override|


BlackTech has used right-to-left-override to obfuscate the filenames of malicious e-mail attachments.(Citation: TrendMicro BlackTech June 2017)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

BlackTech has exploited multiple vulnerabilities for execution, including Microsoft Office vulnerabilities CVE-2012-0158, CVE-2014-6352, CVE-2017-0199, and Adobe Flash CVE-2015-5119.(Citation: TrendMicro BlackTech June 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

BlackTech has exploited a buffer overflow vulnerability in Microsoft Internet Information Services (IIS) 6.0, CVE-2017-7269, in order to establish a new HTTP or command and control (C2) server.(Citation: TrendMicro BlackTech June 2017)|


Blue Mockingbird - G0108

Created: 2020-05-26T20:09:39.139Z

Modified: 2021-10-12T21:46:13.007Z

Contributors: Tony Lambert, Red Canary

Aliases

Blue Mockingbird

Description

Blue Mockingbird is a cluster of observed activity involving Monero cryptocurrency-mining payloads in dynamic-link library (DLL) form on Windows systems. The earliest observed Blue Mockingbird tools were created in December 2019.(Citation: RedCanary Mockingbird May 2020)

Techniques Used

Blue Mockingbird has obtained and used tools such as

Mimikatz.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.012|COR_PROFILER|

Blue Mockingbird has used wmic.exe and Windows Registry modifications to set the COR_PROFILER environment variable to execute a malicious DLL whenever a process loads the .NET CLR.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Blue Mockingbird has obfuscated the wallet address in the payload binary.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Blue Mockingbird has used wmic.exe to set environment variables.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

Blue Mockingbird has used Windows Registry modifications to specify a DLL payload.(Citation: RedCanary Mockingbird May 2020) |
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Blue Mockingbird has collected hardware details for the victim's system, including CPU and memory information.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|


Blue Mockingbird has made their XMRIG payloads persistent as a Windows Service.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Blue Mockingbird has masqueraded their XMRIG payload name by naming it wercplsupporte.dll after the legitimate wercplsupport.dll file.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1134|Access Token Manipulation|

Blue Mockingbird has used JuicyPotato to abuse the

Blue Mockingbird has used Mimikatz to retrieve credentials from LSASS memory.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Blue Mockingbird has used Remote Desktop to log on to servers interactively and manually copy files to remote hosts.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Blue Mockingbird has used Windows Explorer to manually copy malicious files to remote hosts over SMB.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Blue Mockingbird has used PowerShell reverse TCP shells to issue interactive commands over a network connection.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

Blue Mockingbird has used frp, ssf, and Venom to establish SOCKS proxy connections.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1496|Resource Hijacking|


Blue Mockingbird has used XMRIG to mine cryptocurrency on victim systems.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

Blue Mockingbird has used mofcomp.exe to establish WMI Event Subscription persistence mechanisms configured from a *.mof file.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Blue Mockingbird has used batch script files to automate execution and deployment of payloads.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Blue Mockingbird has used Windows Scheduled Tasks to establish persistence on local and remote hosts.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Blue Mockingbird has gained initial access by exploiting CVE-2019-18935, a vulnerability within Telerik UI for ASP.NET AJAX.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using rundll32.exe.(Citation: RedCanary Mockingbird May 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs using regsvr32.exe.(Citation: RedCanary Mockingbird May 2020)    |
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

Blue Mockingbird has executed custom-compiled XMRIG miner DLLs by configuring them to execute via the "wercplsupport" service.(Citation: RedCanary Mockingbird May 2020)   |


BRONZE BUTLER - G0060

Created: 2018-01-16T16:13:52.465Z

Modified: 2021-10-12T19:42:16.869Z

Contributors: Trend Micro Incorporated

Aliases

BRONZE BUTLER,REDBALDKNIGHT,Tick

Description

BRONZE BUTLER is a cyber espionage group with likely Chinese origins that has been active since at least 2008. The group primarily targets Japanese organizations, particularly those in government, biotechnology, electronics manufacturing, and industrial chemistry.(Citation: Trend Micro Daserf Nov 2017)(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)

Techniques Used

BRONZE BUTLER has obtained and used open-source tools such as

Mimikatz,

gsecdump, and

Windows Credential Editor.(Citation: Symantec Tick Apr 2016)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

BRONZE BUTLER has used legitimate applications to side-load malicious DLLs.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

BRONZE BUTLER has used TROJ_GETVERSION to discover system services.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

BRONZE BUTLER has incorporated code into several tools that attempts to terminate anti-virus processes.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

BRONZE BUTLER has used steganography in multiple operations to conceal malicious payloads.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|


BRONZE BUTLER has used tools to enumerate software installed on an infected host.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

BRONZE BUTLER has masked executables with document file icons including Word and Adobe PDF.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

BRONZE BUTLER has made use of Python-based remote access tools.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.002|Right-to-Left Override|

BRONZE BUTLER has used Right-to-Left Override to deceive victims into executing several strains of malware.(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,Office 365,SaaS,Linux,macOS|T1080|Taint Shared Content|

BRONZE BUTLER has placed malware on file shares and given it the same name as legitimate documents on the share.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

BRONZE BUTLER has used VBS and VBE scripts for execution.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

BRONZE BUTLER has used

schtasks to register a scheduled task to execute malware during lateral movement.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

BRONZE BUTLER compromised three Japanese websites using a Flash exploit to perform watering hole attacks.(Citation: Symantec Tick Apr 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|


BRONZE BUTLER has attempted to get users to launch malicious Microsoft Word attachments delivered via spearphishing emails.(Citation: Symantec Tick Apr 2016)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

BRONZE BUTLER has exploited Microsoft Office vulnerabilities CVE-2014-4114, CVE-2018-0802, and CVE-2018-0798 for execution.(Citation: Symantec Tick Apr 2016)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

BRONZE BUTLER used spearphishing emails with malicious Microsoft Word attachments to infect victims.(Citation: Symantec Tick Apr 2016)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.001|Dead Drop Resolver|

BRONZE BUTLER's MSGET downloader uses a dead drop resolver to access malicious payloads.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|The

BRONZE BUTLER uploader or malware the uploader uses

BRONZE BUTLER tools encode data with base64 when posting it to a C2 server.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1550.003|Pass the Ticket|

BRONZE BUTLER has created forged Kerberos Ticket Granting Ticket (TGT) and Ticket Granting Service (TGS) tickets to maintain administrative access.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|


BRONZE BUTLER has used batch scripts and the command-line interface for execution.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

BRONZE BUTLER has given malware the same name as an existing file on the file share server to cause users to unwittingly launch and install the malware on additional systems.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1053.002|At|

BRONZE BUTLER has used

at to register a scheduled task to execute malware during lateral movement.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

BRONZE BUTLER has compressed data into password-protected RAR archives prior to exfiltration.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows,Network|T1124|System Time Discovery|

BRONZE BUTLER has used

BRONZE BUTLER has used various tools to download files, including DGet (a similar tool to wget).(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1548.002|Bypass User Account Control|

BRONZE BUTLER has used a Windows 10 specific tool and xxmm to bypass UAC for privilege escalation.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

BRONZE BUTLER malware has used HTTP for C2.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|


BRONZE BUTLER has exfiltrated files stolen from local systems.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

BRONZE BUTLER has used PowerShell for execution.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

BRONZE BUTLER has used RC4 encryption (for Datper malware) and AES (for xxmm malware) to obfuscate HTTP traffic.

BRONZE BUTLER has also used a tool called RarStar that encodes data with a custom XOR algorithm when posting it to a C2 server.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

BRONZE BUTLER downloader code has included "0" characters at the end of the file to inflate the file size in a likely attempt to evade anti-virus detection.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

BRONZE BUTLER has used various tools (such as Mimikatz and WCE) to perform credential dumping.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|

BRONZE BUTLER has used

BRONZE BUTLER typically use

Net to enumerate systems.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|

BRONZE BUTLER has used a tool to capture screenshots.(Citation: Secureworks BRONZE BUTLER Oct 2017)(Citation: Trend Micro Tick November 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|


BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

BRONZE BUTLER downloads encoded payloads and decodes them on the victim.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

BRONZE BUTLER has exfiltrated files stolen from file shares.(Citation: Secureworks BRONZE BUTLER Oct 2017)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

BRONZE BUTLER has used a batch script that adds a Registry Run key to establish malware persistence.(Citation: Secureworks BRONZE BUTLER Oct 2017)|


Carbanak - G0008

Created: 2017-05-31T21:31:49.021Z

Modified: 2021-10-18T21:02:30.899Z

Contributors: Anastasios Pingios

Aliases

Carbanak,Anunak

Description

Carbanak is a cybercriminal group that has used

Carbanak malware to target financial institutions since at least 2013.

Carbanak may be linked to groups tracked separately as

Cobalt Group and

FIN7 that have also used

Carbanak malware.(Citation: Kaspersky Carbanak)(Citation: FireEye FIN7 April 2017)(Citation: Europol Cobalt Mar 2018)(Citation: Secureworks GOLD NIAGARA Threat Profile)(Citation: Secureworks GOLD KINGSWOOD Threat Profile)

Techniques Used

Carbanak has obtained and used open-source tools such as

PsExec and

Mimikatz.(Citation: Kaspersky Carbanak)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Carbanak has copied legitimate service names to use for malicious services.(Citation: Kaspersky Carbanak)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

Carbanak used legitimate programs such as AmmyyAdmin and Team Viewer for remote interactive C2 to target systems.(Citation: Group-IB Anunak)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

Carbanak installs VNC server software that executes through rundll32.(Citation: Kaspersky Carbanak)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

Carbanak malware installs itself as a service to provide persistence and SYSTEM privileges.(Citation: Kaspersky Carbanak)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1562.004|Disable or Modify System Firewall|

Carbanak may use


Carbanak may use

netsh to add local firewall rule exceptions.(Citation: Group-IB Anunak)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

Carbanak has used a VBScript named "ggldr" that uses Google Apps Script, Sheets, and Forms services for C2.(Citation: Forcepoint Carbanak Google C2)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Carbanak has named malware "svchost.exe," which is the name of the Windows shared service host program.(Citation: Kaspersky Carbanak)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Carbanak actors used legitimate credentials of banking employees to perform operations that sent them millions of dollars.(Citation: Kaspersky Carbanak)|


Chimera - G0114

Created: 2020-08-24T17:01:55.842Z

Modified: 2023-03-22T03:25:24.295Z

Contributors:

Aliases

Chimera

Description

Chimera is a suspected China-based threat group that has been active since at least 2018 targeting the semiconductor industry in Taiwan as well as data from the airline industry.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)

Techniques Used

Chimera has obtained and used tools such as

BloodHound,

Cobalt Strike,

Mimikatz, and

PsExec.(Citation: Cycraft Chimera April 2020)(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Chimera has performed file deletion to evade detection.(Citation: Cycraft Chimera April 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1572|Protocol Tunneling|

Chimera has encapsulated

Cobalt Strike's C2 protocol in DNS and HTTPS.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

Chimera has collected data of interest from network shares.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Chimera has used

Chimera has used

Chimera has used the

Chimera has used

ipconfig,

Ping, and

Chimera has used

Chimera has used

Chimera has queried Registry keys using

Chimera has used

Chimera has used custom DLLs for continuous retrieval of data from memory.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

Chimera has used


Chimera has used

Chimera has registered alternate phone numbers for compromised users to intercept 2FA codes sent via SMS.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1550.002|Pass the Hash|

Chimera has dumped password hashes for use in pass the hash authentication attacks.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Chimera has used HTTPS for C2 communications.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Chimera has used the Windows Command Shell and batch scripts for execution on compromised hosts.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

Chimera has used

PsExec to deploy beacons on compromised systems.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.004|DNS|

Chimera has used

Cobalt Strike to encapsulate C2 in DNS traffic.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Chimera has used side loading to place malicious DLLs in memory.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Chimera has staged stolen data locally on compromised hosts.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1114.001|Local Email Collection|

Chimera has harvested data from victim's e-mail including through execution of

Chimera has harvested data from remote mailboxes including through execution of


Chimera has harvested data from victim's e-mail including through execution of

Chimera has harvested data from remote mailboxes including through execution of

Chimera has collected documents from the victim's SharePoint.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1570|Lateral Tool Transfer|

Chimera has copied tools between compromised hosts using SMB.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.006|Windows Remote Management|

Chimera has used WinRM for lateral movement.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Chimera has used the

Chimera has used the NtdsAudit utility to collect information related to accounts and passwords.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Chimera has used

Chimera has cleared event logs on compromised hosts.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.006|Timestomp|

Chimera has used a Windows version of the Linux

Chimera has used

Chimera has exfiltrated stolen data to OneDrive accounts.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|

Chimera has staged stolen data on designated servers in the target environment.(Citation: NCC Group Chimera January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

Chimera has used