Magic Hound has used Fast Reverse Proxy (FRP) for RDP traffic.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1572|Protocol Tunneling|

Magic Hound has used Plink to tunnel RDP over SSH.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1078.001|Default Accounts|

Magic Hound enabled and used the default system managed account, DefaultAccount, via

Magic Hound has used

Ping for discovery on targeted networks.(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|PRE|T1592.002|Software|

Magic Hound has captured the user-agent strings from visitors to their phishing sites.(Citation: Google Iran Threats October 2021)|
|mitre-attack|enterprise-attack|PRE|T1590.005|IP Addresses|

Magic Hound has captured the IP addresses of visitors to their phishing sites.(Citation: Google Iran Threats October 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567|Exfiltration Over Web Service|

Magic Hound has used the Telegram API

Magic Hound has used Remote Desktop Services to copy tools on targeted systems.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Magic Hound has used quser.exe to identify existing RDP connections.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|


Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

Magic Hound has created local accounts named

Magic Hound has used Powershell to discover email accounts.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Magic Hound has used a tool to run

Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic -

Magic Hound has modified Registry settings for security tools.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1070.003|Clear Command History|

Magic Hound has removed mailbox export requests from compromised Exchange servers.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|

Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet

Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Office 365,IaaS,Linux,macOS,Containers,Network|T1562|Impair Defenses|

Magic Hound has disabled LSA protection on compromised hosts using

Magic Hound has used

Magic Hound has used scheduled tasks to establish persistence and execution.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|


Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.(Citation: DFIR Report APT35 ProxyShell March 2022)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Magic Hound has used multiple web shells to gain execution.(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Magic Hound has conducted watering-hole attacks through media and magazine websites.(Citation: ClearSky Kittens Back 3 August 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

Magic Hound has acquired Amazon S3 buckets to use in C2.(Citation: Check Point APT35 CharmPower January 2022)|
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|

Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.(Citation: Check Point APT35 CharmPower January 2022)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|


Magic Hound has exploited the Log4j utility (CVE-2021-44228), on-premises MS Exchange servers via "ProxyShell" (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), and Fortios SSL VPNs (CVE-2018-13379).(Citation: Check Point APT35 CharmPower January 2022)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: Cybereason PowerLess February 2022)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

Magic Hound has identified high-value email accounts in academia, journalism, NGO's, foreign policy, and national security for targeting.(Citation: Proofpoint TA453 July2021)(Citation: Google Iran Threats October 2021)|
|mitre-attack|enterprise-attack|PRE|T1589|Gather Victim Identity Information|

Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.(Citation: Proofpoint TA453 July2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Magic Hound has obtained and used tools like

Havij,

sqlmap, Metasploit,

Mimikatz, and Plink.(Citation: Check Point Rocket Kitten)(Citation: FireEye APT35 2018)(Citation: Check Point APT35 CharmPower January 2022)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Magic Hound has attempted to lure victims into opening malicious links embedded in emails.(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|


Magic Hound has attempted to lure victims into opening malicious email attachments.(Citation: ClearSky Kittens Back 3 August 2020)|
|mitre-attack|enterprise-attack|PRE|T1585.001|Social Media Accounts|

Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.(Citation: ClearSky Kittens Back 3 August 2020)|
|mitre-attack|enterprise-attack|PRE|T1584.001|Domains|

Magic Hound has used compromised domains to host links targeted to specific phishing victims.(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Proofpoint TA453 July2021)(Citation: Certfa Charming Kitten January 2021)(Citation: Google Iran Threats October 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.(Citation: Certfa Charming Kitten January 2021)|
|mitre-attack|enterprise-attack|PRE|T1598.003|Spearphishing Link|

Magic Hound has used SMS and email messages with links designed to steal credentials or track victims.(Citation: Certfa Charming Kitten January 2021)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Proofpoint TA453 March 2021)(Citation: Proofpoint TA453 July2021)(Citation: Google Iran Threats October 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Windows,Office 365,Google Workspace,macOS,Linux|T1114|Email Collection|

Magic Hound has compromised email credentials in order to steal sensitive data.(Citation: Certfa Charming Kitten January 2021)|
|mitre-attack|enterprise-attack|PRE|T1586.002|Email Accounts|


Magic Hound has compromised email credentials in order to steal sensitive data.(Citation: Certfa Charming Kitten January 2021)|
|mitre-attack|enterprise-attack|PRE|T1586.002|Email Accounts|

Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.(Citation: IBM ITG18 2020)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|

Magic Hound has established email accounts using fake personas for spearphishing operations.(Citation: IBM ITG18 2020)(Citation: Proofpoint TA453 March 2021)|
|mitre-attack|enterprise-attack|PRE|T1589.001|Credentials|

Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites.

Magic Hound has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.(Citation: IBM ITG18 2020)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1566.003|Spearphishing via Service|

Magic Hound used various social media channels (such as LinkedIn) as well as messaging services (such as WhatsApp) to spearphish victims.(Citation: SecureWorks Mia Ash July 2017)(Citation: Microsoft Phosphorus Mar 2019)(Citation: ClearSky Kittens Back 3 August 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,Office 365,Google Workspace|T1098.002|Additional Email Delegate Permissions|


Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA (Outlook Web Access) portal and read hundreds of email communications for information on Middle East organizations.(Citation: FireEye APT35 2018) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071|Application Layer Protocol|

Magic Hound malware has used IRC for C2.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.(Citation: Unit 42 Magic Hound Feb 2017)|
|mitre-attack|enterprise-attack|Windows|T1114.001|Local Email Collection|

Magic Hound has collected .PST archives.(Citation: FireEye APT35 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.(Citation: FireEye APT35 2018)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using

Mimikatz.(Citation: FireEye APT35 2018)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|


Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download

Pupy.(Citation: Secureworks Cobalt Gypsy Feb 2017)(Citation: ClearSky Kittens Back 3 August 2020)(Citation: Certfa Charming Kitten January 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Magic Hound has deleted and overwrote files to cover tracks.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: FireEye APT35 2018)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Magic Hound has used the command-line interface for code execution.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|


Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Magic Hound malware can list running processes.(Citation: Unit 42 Magic Hound Feb 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Magic Hound has used HTTP for C2.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|

Magic Hound malware can take a screenshot and upload the file to its C2 server.(Citation: Unit 42 Magic Hound Feb 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Magic Hound has used PowerShell for execution and privilege escalation.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: FireEye APT35 2018)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Magic Hound malware is capable of keylogging.(Citation: Unit 42 Magic Hound Feb 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|


Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.(Citation: Unit 42 Magic Hound Feb 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

Magic Hound malware can use a SOAP Web service to communicate with its C2 server.(Citation: Unit 42 Magic Hound Feb 2017)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Magic Hound malware has used Registry Run keys to establish persistence.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Magic Hound malware has used VBS scripts for execution.(Citation: Unit 42 Magic Hound Feb 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Magic Hound malware has obtained the victim username and sent it to the C2 server.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Magic Hound has downloaded additional code and files from servers onto victims.(Citation: Unit 42 Magic Hound Feb 2017)(Citation: DFIR Report APT35 ProxyShell March 2022)(Citation: DFIR Phosphorus November 2021)(Citation: Microsoft Iranian Threat Actor Trends November 2021)|


menuPass - G0045

Created: 2017-05-31T21:32:09.054Z

Modified: 2023-03-23T15:06:31.019Z

Contributors: Edward Millington,Michael Cox

Aliases

menuPass,Cicada,POTASSIUM,Stone Panda,APT10,Red Apollo,CVNX,HOGFISH

Description

menuPass is a threat group that has been active since at least 2006. Individual members of menuPass are known to have acted in association with the Chinese Ministry of State Security's (MSS) Tianjin State Security Bureau and worked for the Huaying Haitai Science and Technology Development Company.(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)

menuPass has targeted healthcare, defense, aerospace, finance, maritime, biotechnology, energy, and government sectors globally, with an emphasis on Japanese organizations. In 2016 and 2017, the group is known to have targeted managed IT service providers (MSPs), manufacturing and mining companies, and a university.(Citation: Palo Alto menuPass Feb 2017)(Citation: Crowdstrike CrowdCast Oct 2013)(Citation: FireEye Poison Ivy)(Citation: PWC Cloud Hopper April 2017)(Citation: FireEye APT10 April 2017)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)

Techniques Used

menuPass has used

Wevtutil to remove PowerShell execution logs.(Citation: Securelist APT10 March 2021)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

menuPass has resized and added data to the certificate table to enable the signing of modified files with legitimate signatures.(Citation: Securelist APT10 March 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|


menuPass has leveraged vulnerabilities in Pulse Secure VPNs to hijack sessions.(Citation: Securelist APT10 March 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

menuPass has used and modified open-source tools like

Impacket,

Mimikatz, and

pwdump.(Citation: PWC Cloud Hopper Technical Annex April 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1568.001|Fast Flux DNS|

menuPass has used dynamic DNS service providers to host malicious domains.(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

menuPass has registered malicious domains for use in intrusion campaigns.(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

menuPass has used native APIs including

menuPass has used Ntdsutil to dump credentials.(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

menuPass has used tools to exploit the ZeroLogon vulnerability (CVE-2020-1472).(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

menuPass has used the Csvde tool to collect Active Directory files and data.(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.004|InstallUtil|

menuPass has used


menuPass has used

menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Github AD-Pentest-Script)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.003|Rename System Utilities|

menuPass has renamed

certutil and moved it to a different location on the system to avoid detection based on use of the tool.(Citation: FireEye APT10 Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

menuPass has used

esentutl to change file extensions to their true type that were masquerading as .txt files.(Citation: FireEye APT10 Sept 2018) |
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|

menuPass has staged data on remote MSP systems or other victim networks prior to exfiltration.(Citation: PWC Cloud Hopper April 2017)(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

menuPass has used key loggers to steal usernames and passwords.(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

menuPass has collected various files from the compromised computers.(Citation: DOJ APT10 Dec 2018)(Citation: Symantec Cicada November 2020)
|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

menuPass has encrypted files and information before exfiltration.(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|


menuPass has been seen changing malicious files to appear legitimate.(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.012|Process Hollowing|

menuPass has used process hollowing in iexplore.exe to load the

RedLeaves implant.(Citation: Accenture Hogfish April 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|A

menuPass macro deletes files after it has decoded and decompressed them.(Citation: Accenture Hogfish April 2018)(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

menuPass has encoded strings in its malware with base64 as well as with a simple, single-byte XOR obfuscation using key 0x40.(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

menuPass has used

certutil in a macro to decode base64-encoded content contained in a dropper document attached to an email. The group has also used

UPPERCUT.(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|


menuPass has attempted to get victims to open malicious files such as Windows Shortcuts (.lnk) and/or Microsoft Office documents, sent via email as part of spearphishing campaigns.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

menuPass has sent malicious Office documents via email as part of spearphishing campaigns as well as executables disguised as documents.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)(Citation: FireEye APT10 Sept 2018)(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|

menuPass has used legitimate access granted to Managed Service Providers in order to access victims of interest.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)(Citation: Symantec Cicada November 2020)(Citation: DOJ APT10 Dec 2018)(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

menuPass has used

menuPass stages data prior to exfiltration in multi-part archives, often saved in the Recycle Bin.(Citation: PWC Cloud Hopper April 2017)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|


menuPass has used valid accounts including shared between Managed Service Providers and clients to move between the two environments.(Citation: PWC Cloud Hopper April 2017)(Citation: Symantec Cicada November 2020)(Citation: District Court of NY APT10 Indictment December 2018)(Citation: Securelist APT10 March 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

menuPass uses

PowerSploit to inject shellcode into PowerShell.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

menuPass has used tcping.exe, similar to

Ping, to probe port status on systems of interest.(Citation: PWC Cloud Hopper Technical Annex April 2017)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

menuPass has used Putty Secure Copy Client (PSCP) to transfer data.(Citation: PWC Cloud Hopper April 2017)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

menuPass has used a modified version of pentesting script wmiexec.vbs, which logs into a remote machine using WMI.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Github AD-Pentest-Script)(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

menuPass has collected data from remote systems by mounting network shares with

menuPass uses scripts to enumerate IP ranges on the victim network.

menuPass has also issued the command

PlugX implant to gather information about remote systems on the network.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)|
|mitre-attack|enterprise-attack|Windows|T1003.002|Security Account Manager|


menuPass has used a modified version of pentesting tools wmiexec.vbs and secretsdump.py to dump credentials.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Github AD-Pentest-Script)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

menuPass has used several tools to scan for open NetBIOS nameservers and enumerate NetBIOS sessions.(Citation: PWC Cloud Hopper Technical Annex April 2017)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

menuPass has used DLL search order hijacking.(Citation: PWC Cloud Hopper April 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

menuPass executes commands using a command-line interface and reverse shell. The group has used a modified version of pentesting script wmiexec.vbs to execute commands.(Citation: PWC Cloud Hopper April 2017)(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Github AD-Pentest-Script)(Citation: FireEye APT10 Sept 2018)

menuPass has used malicious macros embedded inside Office documents to execute files.(Citation: Accenture Hogfish April 2018)(Citation: FireEye APT10 Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|

menuPass has used the Microsoft administration tool csvde.exe to export Active Directory data.(Citation: PWC Cloud Hopper Technical Annex April 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

menuPass has compressed files before exfiltration using TAR and RAR.(Citation: PWC Cloud Hopper April 2017)(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|


menuPass has used DLL side-loading to launch versions of Mimikatz and PwDump6 as well as

UPPERCUT.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 Sept 2018)(Citation: Symantec Cicada November 2020)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

menuPass has used a script (atexec.py) to execute a command on a target machine via Task Scheduler.(Citation: PWC Cloud Hopper Technical Annex April 2017)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

menuPass has used RDP connections to move across the victim network.(Citation: PWC Cloud Hopper April 2017)(Citation: District Court of NY APT10 Indictment December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|

menuPass has used a global service provider's IP as a proxy for C2 traffic from a victim.(Citation: FireEye APT10 April 2017)(Citation: FireEye APT10 Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

menuPass has installed updates and new malware on victims.(Citation: PWC Cloud Hopper April 2017)(Citation: District Court of NY APT10 Indictment December 2018)|


Metador - G1013

Created: 2023-01-25T23:57:51.818Z

Modified: 2023-04-14T12:25:35.434Z

Contributors: Massimiliano Romano, BT Security,Sittikorn Sangrattanapitak

Aliases

Metador

Description

Metador is a suspected cyber espionage group that was first reported in September 2022. Metador has targeted a limited number of telecommunication companies, internet service providers, and universities in the Middle East and Africa. Security researchers named the group Metador based on the "I am meta" string in one of the group's malware samples and the expectation of Spanish-language responses from C2 servers.(Citation: SentinelLabs Metador Sept 2022)

Techniques Used

Metador has encrypted their payloads.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Metador has quickly deleted

Metador has used Microsoft's Console Debugger in some of their operations.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Metador has downloaded tools and malware onto a compromised system.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Metador has used the Windows command line to execute commands.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as

Metador has used unique malware in their operations, including

metaMain and

Mafalda.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|


Mafalda.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|

Metador has used TCP for C2.(Citation: SentinelLabs Metador Sept 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Metador has used HTTP for C2.(Citation: SentinelLabs Metador Sept 2022)|


Moafee - G0002

Created: 2017-05-31T21:31:46.025Z

Modified: 2020-03-30T19:09:42.298Z

Contributors:

Aliases

Moafee

Description

Moafee is a threat group that appears to operate from the Guandong Province of China. Due to overlapping TTPs, including similar custom tools, Moafee is thought to have a direct or indirect relationship with the threat group DragonOK. (Citation: Haq 2014)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|Moafee has been known to employ binary padding.(Citation: Haq 2014)|


Mofang - G0103

Created: 2020-05-12T21:23:59.021Z

Modified: 2020-05-29T03:30:39.739Z

Contributors:

Aliases

Mofang

Description

Mofang is a likely China-based cyber espionage group, named for its frequent practice of imitating a victim's infrastructure. This adversary has been observed since at least May 2012 conducting focused attacks against government and critical infrastructure in Myanmar, as well as several other countries and sectors including military, automobile, and weapons industries.(Citation: FOX-IT May 2016 Mofang)

Techniques Used

Mofang delivered spearphishing emails with malicious links included.(Citation: FOX-IT May 2016 Mofang)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Mofang's spearphishing emails required a user to click the link to connect to a compromised website.(Citation: FOX-IT May 2016 Mofang)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Mofang delivered spearphishing emails with malicious documents, PDFs, or Excel files attached.(Citation: FOX-IT May 2016 Mofang)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Mofang's malicious spearphishing attachments required a user to open the file after receiving.(Citation: FOX-IT May 2016 Mofang)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Mofang has compressed the

ShimRat executable within malicious email attachments.

Mofang has also encrypted payloads before they are downloaded to victims.(Citation: FOX-IT May 2016 Mofang)|


Molerats - G0021

Created: 2017-05-31T21:31:55.093Z

Modified: 2021-04-27T20:16:16.057Z

Contributors:

Aliases

Molerats,Operation Molerats,Gaza Cybergang

Description

Molerats is an Arabic-speaking, politically-motivated threat group that has been operating since 2012. The group's victims have primarily been in the Middle East, Europe, and the United States.(Citation: DustySky)(Citation: DustySky2)(Citation: Kaspersky MoleRATs April 2019)(Citation: Cybereason Molerats Dec 2020)

Techniques Used

Molerats has used msiexec.exe to execute an MSI payload.(Citation: Unit42 Molerat Mar 2020) |
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Molerats has created scheduled tasks to persistently run VBScripts.(Citation: Unit42 Molerat Mar 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Molerats decompresses ZIP files once on the victim machine.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Molerats used PowerShell implants on target machines.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Molerats used various implants, including those built with JS, on target machines.(Citation: Kaspersky MoleRATs April 2019)   |
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|


Molerats used various implants, including those built with VBScript, on target machines.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Molerats has sent phishing emails with malicious links included.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Molerats has sent phishing emails with malicious Microsoft Word and PDF attachments.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020)(Citation: Cybereason Molerats Dec 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Molerats has sent malicious files via email that tricked users into clicking Enable Content to run an embedded macro and to download malicious archives.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020)(Citation: Cybereason Molerats Dec 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Molerats has sent malicious links via email trick users into opening a RAR archive and running an executable.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Molerats has delivered compressed executables within ZIP files to victims.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|


Molerats used executables to download malicious files from different sources.(Citation: Kaspersky MoleRATs April 2019)(Citation: Unit42 Molerat Mar 2020) |
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Molerats saved malicious files within the AppData and Startup folders to maintain persistence.(Citation: Kaspersky MoleRATs April 2019)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Molerats has used forged Microsoft code-signing certificates on malware.(Citation: FireEye Operation Molerats)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

Molerats used the public tool BrowserPasswordDump10 to dump passwords saved in browsers on victims.(Citation: DustySky)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Molerats actors obtained a list of active processes on the victim and sent them to C2 servers.(Citation: DustySky)|


Moses Staff - G1009

Created: 2022-08-11T22:47:27.686Z

Modified: 2022-10-24T18:50:12.653Z

Contributors: Hiroki Nagahama, NEC Corporation,Pooja Natarajan, NEC Corporation India,Manikantan Srinivasan, NEC Corporation India

Aliases

Moses Staff

Description

Moses Staff is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. Moses Staff openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.(Citation: Checkpoint MosesStaff Nov 2021)

Security researchers assess Moses Staff is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US.(Citation: Cybereason StrifeWater Feb 2022)

Techniques Used

Moses Staff has used batch scripts that can disable the Windows firewall on specific remote machines.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Moses Staff has used batch scripts that can enable SMB on a compromised host.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

Moses Staff has collected the administrator username from a compromised host.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Moses Staff has used signed drivers from an open source tool called DiskCryptor to evade detection.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Moses Staff has downloaded and installed web shells to following path


Moses Staff has downloaded and installed web shells to following path

Moses Staff collected information about the infected host, including the machine names and OS architecture.(Citation: Checkpoint MosesStaff Nov 2021)
|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Moses Staff has collected the domain name of a compromised network.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Moses Staff has used obfuscated web shells in their operations.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

Moses Staff has built malware, such as

DCSrv and

PyDCrypt, for targeting victims' machines.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Moses Staff has used the commercial tool DiskCryptor.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Moses Staff has dropped a web shell onto a compromised system.(Citation: Checkpoint MosesStaff Nov 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Moses Staff has exploited known vulnerabilities in public-facing infrastructure such as Microsoft Exchange Servers.(Citation: Checkpoint MosesStaff Nov 2021)|


MuddyWater - G0069

Created: 2018-04-18T17:59:24.739Z

Modified: 2023-03-22T04:59:16.032Z

Contributors: Ozer Sarilar, @ozersarilar, STM,Daniyal Naeem, BT Security

Aliases

MuddyWater,Earth Vetala,MERCURY,Static Kitten,Seedworm,TEMP.Zagros

Description

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, defense, and oil and natural gas organizations, in the Middle East, Asia, Africa, Europe, and North America.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)

Techniques Used

MuddyWater maintains persistence on victim networks through side-loading dlls to trick legitimate programs into running malware.(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

MuddyWater has used AES to encrypt C2 responses.(Citation: Talos MuddyWater Jan 2022)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

MuddyWater has exploited the Microsoft Exchange memory corruption vulnerability (CVE-2020-0688).(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|


MuddyWater has exploited the Microsoft Netlogon vulnerability (CVE-2020-1472).(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

MuddyWater has stored a decoy PDF file within a victim's

MuddyWater has used JavaScript files to execute its

POWERSTATS payload.(Citation: ClearSky MuddyWater Nov 2018)(Citation: FireEye MuddyWater Mar 2018)(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

MuddyWater can disable the system's local proxy settings.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

MuddyWater has used a legitimate application, ScreenConnect, to manage systems remotely and move laterally.(Citation: Trend Micro Muddy Water March 2021)(Citation: Anomali Static Kitten February 2021) |
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

MuddyWater has used a PowerShell backdoor to check for Skype connectivity on the target machine.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

MuddyWater has used a PowerShell backdoor to check for Skype connections on the target machine.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

MuddyWater has used developed tools in Python including

Out1.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|


Out1.(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|

MuddyWater has used

MuddyWater has sent targeted spearphishing e-mails with malicious links.(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

MuddyWater has distributed URLs in phishing e-mails that link to lure documents.(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

MuddyWater has specifically targeted government agency employees with spearphishing e-mails.(Citation: Anomali Static Kitten February 2021)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

MuddyWater has used web services including OneHub to distribute remote access tools.(Citation: Anomali Static Kitten February 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|MuddyWater has made use of legitimate tools ConnectWise and Remote Utilities to gain access to target environment.(Citation: Anomali Static Kitten February 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

MuddyWater has used file sharing services including OneHub to distribute tools.(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

MuddyWater has used C2 infrastructure to receive exfiltrated data.(Citation: Reaqta MuddyWater November 2017)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|


MuddyWater has used scheduled tasks to establish persistence.(Citation: Reaqta MuddyWater November 2017)|
|mitre-attack|enterprise-attack|Windows,Office 365|T1137.001|Office Template Macros|

MuddyWater has used a Word Template, Normal.dotm, for persistence.(Citation: Reaqta MuddyWater November 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

MuddyWater has used tools to encode C2 communications including Base64 encoding.(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

MuddyWater has exploited the Office vulnerability CVE-2017-0199 for execution.(Citation: ClearSky MuddyWater June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

MuddyWater has used HTTP for C2 communications.(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

MuddyWater has performed credential dumping with

LaZagne and other tools, including by dumping passwords saved in victim email.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.005|Cached Domain Credentials|

MuddyWater has performed credential dumping with

LaZagne.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)|
|mitre-attack|enterprise-attack|Windows|T1003.004|LSA Secrets|

MuddyWater has performed credential dumping with


MuddyWater has performed credential dumping with

LaZagne.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

MuddyWater has used VBScript files to execute its

POWERSTATS payload, as well as macros.(Citation: FireEye MuddyWater Mar 2018)(Citation: MuddyWater TrendMicro June 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

MuddyWater has stored obfuscated JavaScript code in an image file named temp.jpg.(Citation: ClearSky MuddyWater Nov 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

MuddyWater has run tools including Browser64 to steal passwords saved in victim web browsers.(Citation: Symantec MuddyWater Dec 2018)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1104|Multi-Stage Channels|

MuddyWater has used one C2 to obtain enumeration scripts and monitor web logs, but a different C2 to send data back.(Citation: Talos MuddyWater May 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.004|Compile After Delivery|


MuddyWater has used the .NET csc.exe tool to compile executables from downloaded C# code.(Citation: ClearSky MuddyWater Nov 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

MuddyWater has used malware that can collect the victim’s username.(Citation: Securelist MuddyWater Oct 2018)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

MuddyWater has used malware to collect the victim’s IP address and domain name.(Citation: Securelist MuddyWater Oct 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|

MuddyWater has used malware that can capture screenshots of the victim’s machine.(Citation: Securelist MuddyWater Oct 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

MuddyWater has used malware to check running processes against a hard-coded list of security tools often used by malware researchers.(Citation: Securelist MuddyWater Oct 2018)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

MuddyWater has used malware that can collect the victim’s OS version and machine name.(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)|
|mitre-attack|enterprise-attack|Windows|T1559.002|Dynamic Data Exchange|

MuddyWater has used malware that can execute PowerShell scripts via DDE.(Citation: Securelist MuddyWater Oct 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|


MuddyWater has used malware to obtain a list of running processes on the system.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."(Citation: Securelist MuddyWater Oct 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

MuddyWater has used malware that can upload additional files to the victim’s machine.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

MuddyWater has used a custom tool for creating reverse shells.(Citation: Symantec MuddyWater Dec 2018)|
|mitre-attack|enterprise-attack|Windows|T1559.001|Component Object Model|

MuddyWater has used malware that has the capability to execute malicious code via COM, DCOM, and Outlook.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|

MuddyWater has run a tool that steals passwords saved in victim email.(Citation: Symantec MuddyWater Dec 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|


MuddyWater has used the native Windows cabinet creation tool, makecab.exe, likely to compress stolen data to be uploaded.(Citation: Symantec MuddyWater Dec 2018)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

MuddyWater has used malware that leveraged WMI for execution and querying host information.(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: Talos MuddyWater May 2019)(Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|

MuddyWater has controlled

POWERSTATS from behind a proxy network to obfuscate the C2 location.(Citation: Symantec MuddyWater Dec 2018)

MuddyWater has used a series of compromised websites that victims connected to randomly to relay information to command and control (C2).(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

MuddyWater has used malware that leveraged rundll32.exe in a Registry Run key to execute a .dll.(Citation: Securelist MuddyWater Oct 2018)|
|mitre-attack|enterprise-attack|Windows|T1548.002|Bypass User Account Control|

MuddyWater uses various techniques to bypass UAC.(Citation: ClearSky MuddyWater Nov 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|


MuddyWater has attempted to get users to enable macros and launch malicious Microsoft Word documents delivered via spearphishing emails.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: ClearSky MuddyWater June 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)     |
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

MuddyWater has performed credential dumping with

Mimikatz and procdump64.exe.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: Symantec MuddyWater Dec 2018)(Citation: Trend Micro Muddy Water March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

MuddyWater has disguised malicious executables and used filenames and Registry key names associated with Windows Defender.(Citation: FireEye MuddyWater Mar 2018)(Citation: Talos MuddyWater May 2019)(Citation: Anomali Static Kitten February 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

MuddyWater decoded base64-encoded PowerShell commands using a VBS file.(Citation: FireEye MuddyWater Mar 2018)(Citation: MuddyWater TrendMicro June 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: Talos MuddyWater Jan 2022)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|


MuddyWater has used PowerShell for execution.(Citation: FireEye MuddyWater Mar 2018)(Citation: MuddyWater TrendMicro June 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Symantec MuddyWater Dec 2018)(Citation: ClearSky MuddyWater Nov 2018)(Citation: Talos MuddyWater May 2019)(Citation: Reaqta MuddyWater November 2017)(Citation: Trend Micro Muddy Water March 2021)(Citation: DHS CISA AA22-055A MuddyWater February 2022)(Citation: Talos MuddyWater Jan 2022)|
|mitre-attack|enterprise-attack|Windows|T1218.003|CMSTP|

MuddyWater has used CMSTP.exe and a malicious INF to execute its

POWERSTATS payload.(Citation: FireEye MuddyWater Mar 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

MuddyWater has used mshta.exe to execute its

POWERSTATS payload and to pass a PowerShell one-liner for execution.(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

MuddyWater has compromised third parties and used compromised accounts to send spearphishing emails with targeted attachments to recipients.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: ClearSky MuddyWater June 2019)(Citation: Anomali Static Kitten February 2021)(Citation: Trend Micro Muddy Water March 2021)  (Citation: DHS CISA AA22-055A MuddyWater February 2022)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

MuddyWater has added Registry Run key


MuddyWater has added Registry Run key

MuddyWater has used Daniel Bohannon’s Invoke-Obfuscation framework and obfuscated PowerShell scripts.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: GitHub Invoke-Obfuscation) The group has also used other obfuscation methods, including Base64 obfuscation of VBScripts and PowerShell commands.(Citation: Unit 42 MuddyWater Nov 2017)(Citation: FireEye MuddyWater Mar 2018)(Citation: Securelist MuddyWater Oct 2018)(Citation: Talos MuddyWater May 2019)(Citation: ClearSky MuddyWater June 2019)(Citation: Trend Micro Muddy Water March 2021)(Citation: Talos MuddyWater Jan 2022)|


Mustang Panda - G0129

Created: 2021-04-12T15:56:28.861Z

Modified: 2023-03-22T22:01:13.781Z

Contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet

Aliases

Mustang Panda,TA416,RedDelta,BRONZE PRESIDENT

Description

Mustang Panda is a China-based cyber espionage threat actor that was first observed in 2017 but may have been conducting operations since at least 2014. Mustang Panda has targeted government entities, nonprofits, religious, and other non-governmental organizations in the U.S., Europe, Mongolia, Myanmar, Pakistan, and Vietnam, among others.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)

Techniques Used

Mustang Panda has delivered web bugs to profile their intended targets.(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

Mustang Panda has hosted malicious payloads on DropBox including

PlugX.(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

Mustang Panda has used DropBox URLs to deliver variants of

PlugX.(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|

Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns.(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|PRE|T1608|Stage Capabilities|

Mustang Panda has used servers under their control to validate tracking pixels sent to phishing victims.(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|Windows|T1036.007|Double File Extension|


Mustang Panda has used an additional filename extension to hide the true file type.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.003|Archive via Custom Method|

Mustang Panda has encrypted documents with RC4 prior to exfiltration.(Citation: Avira Mustang Panda January 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.004|InstallUtil|

Mustang Panda has used

Mustang Panda has used a customized

PlugX variant which could spread through USB connections.(Citation: Avira Mustang Panda January 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1052.001|Exfiltration over USB|

Mustang Panda has used a customized

PlugX variant which could exfiltrate documents from air-gapped networks.(Citation: Avira Mustang Panda January 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Mustang Panda has used

Mustang Panda has gathered system information using

Mustang Panda has used spearphishing attachments to deliver initial access payloads.(Citation: Recorded Future REDDELTA July 2020)(Citation: Proofpoint TA416 November 2020)(Citation: Google TAG Ukraine Threat Landscape March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Mustang Panda has used names like

PlugX, and a file named

Cobalt Strike payload.(Citation: Recorded Future REDDELTA July 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

Mustang Panda has used junk code within their DLL files to hinder analysis.(Citation: Avira Mustang Panda January 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Mustang Panda has used


Mustang Panda has used

Mustang Panda has encrypted C2 communications with RC4.(Citation: Recorded Future REDDELTA July 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Mustang Panda has used

Mustang Panda has downloaded additional executables following the initial infection stage.(Citation: Recorded Future REDDELTA July 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Mustang Panda has created the registry key

Mustang Panda's

PlugX variant has created a hidden folder on USB drives named

Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.(Citation: Avira Mustang Panda January 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Mustang Panda has delivered malicious links to their intended targets.(Citation: McAfee Dianxun March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

Mustang Panda used custom batch scripts to collect files automatically from a targeted system.(Citation: Secureworks BRONZE PRESIDENT December 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

Mustang Panda has installed TeamViewer on targeted systems.(Citation: Secureworks BRONZE PRESIDENT December 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.003|NTDS|

Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file.

Mustang Panda has also used

Mustang Panda has stored collected credential files in


Mustang Panda has used vssadmin to create a volume shadow copy and retrieve the NTDS.dit file.

Mustang Panda has also used

Mustang Panda has stored collected credential files in

Mustang Panda has also stored documents for exfiltration in a hidden folder on USB drives.(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Avira Mustang Panda January 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Mustang Panda will delete their tools and files, and kill processes after their objectives are reached.(Citation: Secureworks BRONZE PRESIDENT December 2019)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Mustang Panda have acquired C2 domains prior to operations.(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Recorded Future REDDELTA July 2020)(Citation: McAfee Dianxun March 2021)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

Mustang Panda's custom ORat tool uses a WMI event consumer to maintain persistence.(Citation: Secureworks BRONZE PRESIDENT December 2019)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

Mustang Panda has used mshta.exe to launch collection scripts.(Citation: Secureworks BRONZE PRESIDENT December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Mustang Panda has used RAR to create password-protected archives of collected documents prior to exfiltration.(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Avira Mustang Panda January 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Mustang Panda has searched the victim system for the


Mustang Panda has searched the victim system for the

Mustang Panda has created a scheduled task to execute additional malicious software, as well as maintain persistence.(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: McAfee Dianxun March 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Mustang Panda has executed HTA files via cmd.exe, and used batch scripts for collection.(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Avira Mustang Panda January 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Mustang Panda has used a legitimately signed executable to execute a malicious payload within a DLL file.(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Recorded Future REDDELTA July 2020)(Citation: Proofpoint TA416 November 2020)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Mustang Panda has executed PowerShell scripts via WMI.(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Mustang Panda has communicated with its C2 via HTTP POST requests.(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Recorded Future REDDELTA July 2020)(Citation: McAfee Dianxun March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|


Mustang Panda has sent malicious links including links directing victims to a Google Drive folder.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: McAfee Dianxun March 2021)(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Mustang Panda has exploited CVE-2017-0199 in Microsoft Word to execute code.(Citation: Crowdstrike MUSTANG PANDA June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Mustang Panda has delivered initial payloads hidden using archives and encoding measures.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)(Citation: Recorded Future REDDELTA July 2020)(Citation: Proofpoint TA416 November 2020)(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Mustang Panda has sent malicious files requiring direct victim interaction to execute.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Avira Mustang Panda January 2020)(Citation: Recorded Future REDDELTA July 2020)(Citation: Google TAG Ukraine Threat Landscape March 2022)(Citation: Proofpoint TA416 Europe March 2022)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Mustang Panda has used malicious PowerShell scripts to enable execution.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|


Mustang Panda has embedded VBScript components in LNK files to download additional files and automate collection.(Citation: Crowdstrike MUSTANG PANDA June 2018)(Citation: Anomali MUSTANG PANDA October 2019)(Citation: Secureworks BRONZE PRESIDENT December 2019)|


Naikon - G0019

Created: 2017-05-31T21:31:54.232Z

Modified: 2021-08-19T18:23:23.507Z

Contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet

Aliases

Naikon

Description

Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020).(Citation: CameraShy) Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).(Citation: CameraShy)(Citation: Baumgartner Naikon 2015)

While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.(Citation: Baumgartner Golovkin Naikon 2015)

Techniques Used

Naikon renamed a malicious service

Naikon has modified a victim's Windows Run registry to establish persistence.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Naikon has disguised malicious programs as Google Chrome, Adobe, and VMware executables.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Naikon has used the LadonGo scanner to scan target networks.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Naikon has used a netbios scanner for remote machine identification.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|


Naikon has used a netbios scanner for remote machine identification.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Naikon has used WMIC.exe for lateral movement.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Naikon has used schtasks.exe for lateral movement in compromised networks.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

Naikon has used administrator credentials for lateral movement in compromised networks.(Citation: Bitdefender Naikon April 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Naikon has used malicious e-mail attachments to deliver malware.(Citation: CheckPoint Naikon May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Naikon has convinced victims to open malicious attachments to execute malware.(Citation: CheckPoint Naikon May 2020)|
|mitre-attack|enterprise-attack|Windows,Office 365|T1137.006|Add-ins|

Naikon has used the RoyalRoad exploit builder to drop a second stage loader, intel.wll, into the Word Startup folder on the compromised host.(Citation: CheckPoint Naikon May 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Naikon has used DLL side-loading to load malicious DLL's into legitimate executables.(Citation: CheckPoint Naikon May 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Naikon uses commands such as

Naikon uses commands such as


Nomadic Octopus - G0133

Created: 2021-08-24T17:04:27.002Z

Modified: 2022-09-02T18:03:55.294Z

Contributors:

Aliases

Nomadic Octopus,DustSquad

Description

Nomadic Octopus is a Russian-speaking cyber espionage threat group that has primarily targeted Central Asia, including local governments, diplomatic missions, and individuals, since at least 2014. Nomadic Octopus has been observed conducting campaigns involving Android and Windows malware, mainly using the Delphi programming language, and building custom variants.(Citation: Security Affairs DustSquad Oct 2018)(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)

Techniques Used

Nomadic Octopus as attempted to lure victims into clicking on malicious attachments within spearphishing emails.(Citation: Securelist Octopus Oct 2018)(Citation: ESET Nomadic Octopus 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

Nomadic Octopus executed PowerShell in a hidden window.(Citation: ESET Nomadic Octopus 2018) |
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Nomadic Octopus has used PowerShell for execution.(Citation: ESET Nomadic Octopus 2018) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Nomadic Octopus has used malicious macros to download additional files to the victim's machine.(Citation: ESET Nomadic Octopus 2018) |
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Nomadic Octopus used

Nomadic Octopus attempted to make

Octopus appear as a  Telegram Messenger with a Russian interface.(Citation: Securelist Octopus Oct 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|


Nomadic Octopus has targeted victims with spearphishing emails containing malicious attachments.(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)|


OilRig - G0049

Created: 2017-12-14T16:46:06.044Z

Modified: 2023-02-06T20:58:52.317Z

Contributors: Robert Falcone,Bryan Lee,Dragos  Threat  Intelligence

Aliases

OilRig,COBALT GYPSY,IRN2,APT34,Helix Kitten,Evasive Serpens

Description

OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government, energy, chemical, and telecommunications. It appears the group carries out supply chain attacks, leveraging the trust relationship between organizations to attack their primary targets. FireEye assesses that the group works on behalf of the Iranian government based on infrastructure details that contain references to Iran, use of Iranian infrastructure, and targeting that aligns with nation-state interests.(Citation: Palo Alto OilRig April 2017)(Citation: ClearSky OilRig Jan 2017)(Citation: Palo Alto OilRig May 2016)(Citation: Palo Alto OilRig Oct 2016)(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 QUADAGENT July 2018)

Techniques Used

OilRig has used tools to identify if a mouse is connected to a targeted system.(Citation: Check Point APT34 April 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

OilRig has used VBSscipt macros for execution on compromised hosts.(Citation: Check Point APT34 April 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1497.001|System Checks|

OilRig has used macros to verify if a mouse is connected to a compromised machine.(Citation: Check Point APT34 April 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|


OilRig has used .doc file extensions to mask malicious executables.(Citation: Check Point APT34 April 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1555.004|Windows Credential Manager|

OilRig has used credential dumping tool named VALUEVAULT to steal credentials from the Windows Credential Manager.(Citation: FireEye APT34 July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Office 365|T1137.004|Outlook Home Page|

OilRig has abused the Outlook Home Page feature for persistence.

OilRig has also used CVE-2017-11774 to roll back the initial patch designed to protect against Home Page abuse.(Citation: FireEye Outlook Dec 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.003|Windows Command Shell|

OilRig has used macros to deliver malware such as

QUADAGENT and

OopsIE.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig ISMAgent July 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Nov 2018)

OilRig has used batch scripts.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig ISMAgent July 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Nov 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

OilRig has used credential dumping tools such as

LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT35 2018)(Citation: FireEye APT34 July 2019)


OilRig has also used tool named PICKPOCKET to dump passwords from web browsers.(Citation: FireEye APT34 July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

OilRig has used credential dumping tools such as

LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT35 2018)(Citation: FireEye APT34 July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.005|Cached Domain Credentials|

OilRig has used credential dumping tools such as

LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT35 2018)(Citation: FireEye APT34 July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.004|LSA Secrets|

OilRig has used credential dumping tools such as

LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT35 2018)(Citation: FireEye APT34 July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1069.002|Domain Groups|

OilRig has used

OilRig has run


OilRig has used

OilRig has run

OilRig has delivered malicious links to achieve execution on the target system.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Crowdstrike Helix Kitten Nov 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071.004|DNS|

OilRig has used DNS for C2 including the publicly available

OilRig has used the Plink utility and other tools to create tunnels to C2 servers.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT34 July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1566.003|Spearphishing via Service|

OilRig has used LinkedIn to send spearphishing links.(Citation: FireEye APT34 July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|

OilRig has used credential dumping tools such as

LaZagne to steal credentials to accounts logged into the compromised system and to Outlook Web Access.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT35 2018)(Citation: FireEye APT34 July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

OilRig has sent spearphising emails with malicious links to potential victims.(Citation: Unit 42 OopsIE! Feb 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|


OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: FireEye APT34 July 2019)(Citation: Check Point APT34 April 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

OilRig has used the publicly available tool SoftPerfect Network Scanner as well as a custom tool called GOLDIRONY to conduct network scanning.(Citation: FireEye APT34 Webinar Dec 2017)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

OilRig has sent spearphising emails with malicious attachments to potential victims using compromised and/or spoofed email accounts.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Crowdstrike Helix Kitten Nov 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1047|Windows Management Instrumentation|

OilRig has used WMI for execution.(Citation: FireEye APT34 Webinar Dec 2017)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1218.001|Compiled HTML File|

OilRig has used a CHM payload to load and execute another malicious file once delivered to a victim.(Citation: Palo Alto OilRig May 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|


OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Crowdstrike Helix Kitten Nov 2018)(Citation: Check Point APT34 April 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

OilRig can download remote files onto victims.(Citation: FireEye APT34 Dec 2017)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

OilRig has used keylogging tools called KEYPUNCH and LONGWATCH.(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT34 July 2019)

OilRig has used brute force techniques to obtain credentials.(Citation: FireEye APT34 Webinar Dec 2017)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1573.002|Asymmetric Cryptography|

OilRig used the Plink utility and other tools to create tunnels to C2 servers.(Citation: FireEye APT34 Webinar Dec 2017)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

OilRig uses remote services such as VPN, Citrix, or OWA to persist in an environment.(Citation: FireEye APT34 Webinar Dec 2017)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS,IaaS,Network|T1201|Password Policy Discovery|

OilRig has used net.exe in a script with

OilRig has a tool called CANDYKING to capture a screenshot of user's desktop.(Citation: FireEye APT34 Webinar Dec 2017)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|


OilRig has run

OilRig has exfiltrated data over FTP separately from its primary C2 channel over DNS.(Citation: Palo Alto OilRig Oct 2016)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1012|Query Registry|

OilRig has used

OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

OilRig has run

OilRig has used web shells, often to maintain access to a victim network.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

OilRig has used automated collection.(Citation: Unit42 OilRig Playbook 2023)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1069.001|Local Groups|

OilRig has used

OilRig has used PowerShell scripts for execution, including use of a macro to run a PowerShell command to decode file contents.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig New Delivery Oct 2017)(Citation: Crowdstrike Helix Kitten Nov 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|


OilRig has used compromised credentials to access other systems on a victim network.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

OilRig has used various types of scripting for execution.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig ISMAgent July 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Nov 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS|T1021.004|SSH|

OilRig has used Putty to access compromised systems.(Citation: Unit42 OilRig Playbook 2023)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.001|LSASS Memory|

OilRig has used credential dumping tools such as

Mimikatz to steal credentials to accounts logged into the compromised system and to Outlook Web Access.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT35 2018)(Citation: FireEye APT34 July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

OilRig has run


OilRig has run

OilRig has encrypted and encoded data in its malware, including by using base64.(Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 QUADAGENT July 2018)(Citation: Unit42 OilRig Playbook 2023)(Citation: Crowdstrike Helix Kitten Nov 2018)(Citation: Unit42 OilRig Nov 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

OilRig has run

OilRig has deleted files associated with their payload after execution.(Citation: FireEye APT34 Dec 2017)(Citation: Unit 42 OopsIE! Feb 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1007|System Service Discovery|

OilRig has used

OilRig has used HTTP for C2.(Citation: Unit42 OilRig Playbook 2023)(Citation: FireEye APT34 Webinar Dec 2017)(Citation: FireEye APT34 July 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1008|Fallback Channels|

OilRig malware ISMAgent falls back to its DNS tunneling mechanism if it is unable to reach the C2 server over HTTP.(Citation: OilRig ISMAgent July 2017)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|A

OilRig macro has run a PowerShell command to decode file contents.

OilRig has also used

certutil to decode base64-encoded files on victims.(Citation: FireEye APT34 Dec 2017)(Citation: OilRig New Delivery Oct 2017)(Citation: Unit 42 OopsIE! Feb 2018)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1087.002|Domain Account|

OilRig has run


OilRig has run

OilRig has used

OilRig has tested malware samples to determine AV detection and subsequently modified the samples to ensure AV evasion.(Citation: Palo Alto OilRig April 2017)(Citation: Unit42 OilRig Nov 2018)|
|mitre-attack|enterprise-attack,ics-attack|Engineering Workstation|T0853|Scripting|

OilRig has embedded a macro within spearphishing attachments that has been made up of both a VBScript and a PowerShell script.(Citation: Robert Falcone, Bryan Lee May 2016)|
|mitre-attack|enterprise-attack,ics-attack|Control Server,Data Historian,Engineering Workstation,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0859|Valid Accounts|

OilRig utilized stolen credentials to gain access to victim machines.(Citation: Dragos)|
|mitre-attack|enterprise-attack,ics-attack|Engineering Workstation,Human-Machine Interface,Control Server,Data Historian|T0865|Spearphishing Attachment|

OilRig used spearphishing emails with malicious Microsoft Excel spreadsheet attachments. (Citation: Robert Falcone, Bryan Lee May 2016)|
|mitre-attack|enterprise-attack,ics-attack|None|T0817|Drive-by Compromise|

OilRig has been seen utilizing watering hole attacks to collect credentials which could be used to gain access into ICS networks. (Citation: Eduard Kovacs May 2018)|
|mitre-attack|enterprise-attack,ics-attack|Human-Machine Interface,Control Server,Data Historian,Engineering Workstation|T0869|Standard Application Layer Protocol|

OilRig communicated with its command and control using HTTP requests. (Citation: Robert Falcone, Bryan Lee May 2016)|


Orangeworm - G0071

Created: 2018-10-17T00:14:20.652Z

Modified: 2021-10-26T22:29:09.327Z

Contributors: Elger Vinicius S. Rodrigues, @elgervinicius, CYBINT Centre

Aliases

Orangeworm

Description

Orangeworm is a group that has targeted organizations in the healthcare sector in the United States, Europe, and Asia since at least 2015, likely for the purpose of corporate espionage.(Citation: Symantec Orangeworm April 2018)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|Orangeworm has copied its backdoor across open network shares, including ADMIN$, C$WINDOWS, D$WINDOWS, and E$WINDOWS.(Citation: Symantec Orangeworm April 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|Orangeworm has used HTTP for C2.(Citation: Symantec Orangeworm IOCs April 2018)|


Patchwork - G0040

Created: 2017-05-31T21:32:07.145Z

Modified: 2023-03-22T05:08:20.780Z

Contributors:

Aliases

Patchwork,Hangover Group,Dropping Elephant,Chinastrats,MONSOON,Operation Hangover

Description

Patchwork is a cyber espionage group that was first observed in December 2015. While the group has not been definitively attributed, circumstantial evidence suggests the group may be a pro-Indian or Indian entity. Patchwork has been seen targeting industries related to diplomatic and government agencies. Much of the code used by this group was copied and pasted from online forums. Patchwork was also seen operating spearphishing campaigns targeting U.S. think tank groups in March and April of 2018.(Citation: Cymmetria Patchwork) (Citation: Symantec Patchwork)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)

Techniques Used

Patchwork has used embedded image tags (known as web bugs) with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Patchwork has obtained and used open-source tools such as

QuasarRAT.(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|PRE|T1587.002|Code Signing Certificates|

Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.(Citation: Unit 42 BackConfig May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|


Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.(Citation: Symantec Patchwork)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)(Citation: Unit 42 BackConfig May 2020)|
|mitre-attack|enterprise-attack|Windows|T1197|BITS Jobs|

Patchwork has used BITS jobs to download malicious payloads.(Citation: Unit 42 BackConfig May 2020)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.(Citation: Unit 42 BackConfig May 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Patchwork used Visual Basic Scripts (VBS) on victim machines.(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

Patchwork encrypted the collected files' path with AES and then encoded them with base64.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|A

Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|A

Patchwork .dll that contains

BADNEWS is loaded and executed using DLL side-loading.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1559.002|Dynamic Data Exchange|

Patchwork leveraged the DDE protocol to deliver their malware.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.005|Indicator Removal from Tools|


Patchwork apparently altered

NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Patchwork removed certain files and replaced them so they could not be retrieved.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

Patchwork has obfuscated a script with Crypto Obfuscator.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

Patchwork apparently altered

NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|A

Patchwork file stealer can run a TaskScheduler DLL to add persistence.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

Patchwork developed a file stealer to search C:\ and collect files with certain extensions.


Patchwork developed a file stealer to search C:\ and collect files with certain extensions.

Patchwork also executed a script to enumerate all drives, store them as a list, and upload generated files to the C2 server.(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Patchwork has used watering holes to deliver files with exploits to initial victims.(Citation: Symantec Patchwork)(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Patchwork has used spearphishing with links to deliver files with exploits to initial victims.(Citation: Symantec Patchwork)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Unit 42 BackConfig May 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.(Citation: Cymmetria Patchwork)(Citation: Securelist Dropping Elephant)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|


Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.(Citation: Cymmetria Patchwork)(Citation: Securelist Dropping Elephant)(Citation: Symantec Patchwork)(Citation: PaloAlto Patchwork Mar 2018)(Citation: TrendMicro Patchwork Dec 2017)(Citation: Volexity Patchwork June 2018)(Citation: Unit 42 BackConfig May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.001|Dead Drop Resolver|

Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.(Citation: Securelist Dropping Elephant)|
|mitre-attack|enterprise-attack|Windows|T1055.012|Process Hollowing|A

Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.(Citation: Cymmetria Patchwork)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|A

Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|A

Patchwork payload was packed with UPX.(Citation: Securelist Dropping Elephant)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Patchwork payloads download additional files from the C2 server.(Citation: Securelist Dropping Elephant)(Citation: TrendMicro Patchwork Dec 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|