FIN6 has used Comodo code-signing certificates.(Citation: Security Intelligence More Eggs Aug 2019)    |
|mitre-attack|enterprise-attack,ics-attack|Windows|T1569.002|Service Execution|

FIN6 has created Windows services to execute encoded PowerShell commands.(Citation: FireEye FIN6 Apr 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1102|Web Service|

FIN6 has used Pastebin and Google Storage to host content for their operations.(Citation: FireEye FIN6 Apr 2019)

FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.(Citation: FireEye FIN6 Apr 2019)  |
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.001|Remote Desktop Protocol|

FIN6 used RDP to move laterally in victim networks.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1572|Protocol Tunneling|

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.(Citation: FireEye FIN6 April 2016)(Citation: Trend Micro FIN6 October 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|To move laterally on a victim network,


FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)(Citation: Visa FIN6 Feb 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1560.003|Archive via Custom Method|

FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.(Citation: FireEye FIN6 April 2016)(Citation: Trend Micro FIN6 October 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1560|Archive Collected Data|Following data collection,

FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1573.002|Asymmetric Cryptography|

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.001|LSASS Memory|

FIN6 has used

Windows Credential Editor for credential dumping.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and


FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and

FrameworkPOS.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1087.002|Domain Account|

FIN6 has used Metasploit’s

PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|


FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)(Citation: Visa FIN6 Feb 2019)|


FIN7 - G0046

Created: 2017-05-31T21:32:09.460Z

Modified: 2023-03-22T03:51:04.185Z

Contributors: Edward Millington

Aliases

FIN7,GOLD NIAGARA,ITG14,Carbon Spider

Description

FIN7 is a financially-motivated threat group that has been active since 2013 primarily targeting the U.S. retail, restaurant, and hospitality sectors, often using point-of-sale malware. A portion of

FIN7 was run out of a front company called Combi Security. Since 2020

FIN7 shifted operations to a big game hunting (BGH) approach including use of

REvil ransomware and their own Ransomware as a Service (RaaS), Darkside.

FIN7 may be linked to the

Carbanak Group, but there appears to be several groups using

Carbanak malware and are therefore tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)

Techniques Used

FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.(Citation: FBI Flash FIN7 USB)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

FIN7 has collected files and other sensitive information from a compromised network.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

FIN7 has exfiltrated stolen data to the MEGA file sharing site.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1021.005|VNC|


FIN7 has used TightVNC to control compromised hosts.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,IaaS|T1486|Data Encrypted for Impact|

FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.001|Remote Desktop Protocol|

FIN7 has used RDP to move laterally in victim environments.(Citation: CrowdStrike Carbon Spider August 2021)
|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS|T1021.004|SSH|

FIN7 has used SSH to move laterally through victim environments.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

FIN7 has harvested valid administrative credentials for lateral movement.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1558.003|Kerberoasting|

FIN7 has used Kerberoasting for credential access and to enable lateral movement.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|


FIN7 has attempted to run Darkside ransomware with the filename sleep.exe.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

FIN7 has conducted broad phishing campaigns using malicious links.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

FIN7 has used malicious links to lure victims into downloading malware.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1047|Windows Management Instrumentation|

FIN7 has used WMI to install malware on targeted systems.(Citation: eSentire FIN7 July 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.001|Domains|

FIN7 has registered look-alike domains for use in phishing campaigns.(Citation: eSentire FIN7 July 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1008|Fallback Channels|

FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1587.001|Malware|

FIN7 has developed malware for use in operations, including the creation of infected removable media.(Citation: FBI Flash FIN7 USB)(Citation: FireEye FIN7 Oct 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.007|JavaScript|


FIN7 used JavaScript scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

FIN7 used VBS scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.003|Windows Command Shell|

FIN7 used the command prompt to launch commands on the victim’s machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019) |
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1497.002|User Activity Based Checks|

FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.(Citation: FireEye FIN7 April 2017)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.(Citation: FireEye FIN7 April 2017)(Citation: DOJ FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: eSentire FIN7 July 2021)(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1125|Video Capture|


FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment.(Citation: FireEye FIN7 Aug 2018)(Citation: DOJ FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1543.003|Windows Service|

FIN7 created new Windows services and added them to the startup directories for persistence.(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows|T1553.002|Code Signing|

FIN7 has signed

Carbanak payloads with legally purchased code signing certificates.

FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

FIN7 used SQL scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|

FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.(Citation: FireEye FIN7 April 2017)(Citation: eSentire FIN7 July 2021)(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071.004|DNS|


FIN7 has performed C2 using DNS via A, OPT, and TXT records.(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1113|Screen Capture|

FIN7 captured screenshots and desktop video recordings.(Citation: DOJ FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1559.002|Dynamic Data Exchange|

FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.(Citation: CyberScoop FIN7 Oct 2017)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1218.005|Mshta|

FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.(Citation: FireEye FIN7 April 2017)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|

FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload.(Citation: FireEye FIN7 April 2017)(Citation: Morphisec FIN7 June 2017)(Citation: FBI Flash FIN7 USB)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.(Citation: FireEye FIN7 April 2017)(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|


FIN7 malware has created scheduled tasks to establish persistence.(Citation: FireEye FIN7 April 2017)(Citation: Morphisec FIN7 June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.(Citation: FireEye FIN7 April 2017)(Citation: DOJ FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1546.011|Application Shimming|

FIN7 has used application shim databases for persistence.(Citation: FireEye FIN7 Shim Databases)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.(Citation: Morphisec FIN7 June 2017)|


FIN8 - G0061

Created: 2018-04-18T17:59:24.739Z

Modified: 2023-03-22T03:52:13.089Z

Contributors: Daniyal Naeem, BT Security

Aliases

FIN8

Description

FIN8 is a financially motivated threat group known to launch tailored spearphishing campaigns targeting the retail, restaurant, and hospitality industries. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Fin8 May 2016)

Techniques Used

FIN8 has injected malicious code into a new svchost.exe process.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

FIN8 has used HTTPS for command and control.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

FIN8 has used WMI event subscriptions for persistence.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1134.001|Token Impersonation/Theft|

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

FIN8 has used

FIN8 has retrieved a list of trusted domains by using

Nltest.exe /domain_trusts

FIN8 has used emails with malicious links to lure victims into installing malware.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|


FIN8 has used malicious e-mail attachments to lure victims into executing malware.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

FIN8 has exploited the CVE-2016-0167 local vulnerability.(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution.

FIN8 has also used WMIC for lateral movement as well as during and post compromise cleanup activities.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

FIN8 has used scheduled tasks to maintain RDP backdoors.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

FIN8 has used RAR to compress collected data before exfiltration.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1573.002|Asymmetric Cryptography|

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

FIN8 has used remote code execution to download subsequent payloads.(Citation: FireEye Fin8 May 2016)(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|


FIN8 has used RDP for lateral movement.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

FIN8 has deleted Registry keys during post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|

FIN8 aggregates staged data from a network into a single location.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments.

FIN8 also obfuscates malicious macros delivered as payloads.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

FIN8 has used

dsquery and other Active Directory utilities to enumerate hosts; they have also used

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1070.001|Clear Windows Event Logs|

FIN8 has cleared logs during post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1048.003|Exfiltration Over Unencrypted Non-C2 Protocol|


FIN8 has used FTP to exfiltrate collected data.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

FIN8 has used valid accounts for persistence and lateral movement.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

FIN8's malicious spearphishing payloads are executed as

PowerShell.

FIN8 has also used

PowerShell for lateral movement and credential access.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|


FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)

FIN8 has also executed commands remotely via

cmd.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)|


Fox Kitten - G0117

Created: 2020-12-21T21:49:47.307Z

Modified: 2023-03-22T03:53:37.888Z

Contributors:

Aliases

Fox Kitten,UNC757,Parisite,Pioneer Kitten

Description

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: Dragos PARISITE )(Citation: ClearSky Pay2Kitten December 2020)

Techniques Used

Fox Kitten has base64 encoded scripts to avoid detection.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

Fox Kitten has used Amazon Web Services to host C2.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|PRE|T1585.001|Social Media Accounts|

Fox Kitten has used a Twitter account to communicate with ransomware victims.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|PRE|T1585|Establish Accounts|

Fox Kitten has created KeyBase accounts to communicate with ransomware victims.(Citation: ClearSky Pay2Kitten December 2020)(Citation: Check Point Pay2Key November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|


Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)(Citation: Check Point Pay2Key November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

Fox Kitten has created a local user account with administrator privileges.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

Fox Kitten has brute forced RDP credentials.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

Fox Kitten has used a Perl reverse shell to communicate with C2.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Fox Kitten has used 7-Zip to archive data.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Fox Kitten has downloaded additional tools including

PsExec directly to endpoints.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|IaaS,SaaS|T1530|Data from Cloud Storage|

Fox Kitten has obtained files from the victim's cloud storage instances.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|


Fox Kitten has searched local system resources to access sensitive documents.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

Fox Kitten has searched network shares to access sensitive documents.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,SaaS,Office 365,Google Workspace,IaaS|T1213|Data from Information Repositories|

Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1021.005|VNC|

Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

Fox Kitten has used the PuTTY and Plink tools for lateral movement.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Fox Kitten has used valid accounts to access SMB shares.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1217|Browser Information Discovery|

Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|


Fox Kitten has used RDP to log in and move laterally in the target environment.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|

Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|

Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Fox Kitten has used Angry IP Scanner to detect remote systems.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Fox Kitten has used WizTree to obtain network files and directory listings.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1003.003|NTDS|

Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|


Fox Kitten has accessed files to gain valid credentials.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.005|Password Managers|

Fox Kitten has used scripts to access credential information from the KeePass database.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Fox Kitten has used prodump to dump credentials from LSASS.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Fox Kitten has base64 encoded payloads to avoid detection.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Fox Kitten has used PowerShell scripts to access credential data.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

Fox Kitten has used sticky keys to launch a command prompt.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|


Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Fox Kitten has used cmd.exe likely as a password changing mechanism.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Fox Kitten has installed web shells on compromised hosts to maintain access.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Fox Kitten has used valid credentials with various services during lateral movement.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1572|Protocol Tunneling|

Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as

Ngrok and custom tool SSHMinion.(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|


Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.(Citation: ClearkSky Fox Kitten February 2020)(Citation: Dragos PARISITE )(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

Fox Kitten has exploited known vulnerabilities in remote services including RDP.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: ClearSky Pay2Kitten December 2020)|


GALLIUM - G0093

Created: 2019-07-18T20:47:50.050Z

Modified: 2022-08-12T21:26:22.303Z

Contributors: Daniyal Naeem, BT Security,Cybereason Nocturnus, @nocturnus

Aliases

GALLIUM,Operation Soft Cell

Description

GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)(Citation: Unit 42 PingPull Jun 2022)

Techniques Used

GALLIUM has used Taiwan-based servers that appear to be exclusive to

GALLIUM.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1570|Lateral Tool Transfer|

GALLIUM has used

PsExec to move laterally between hosts in the target network.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

GALLIUM used Web shells and


GALLIUM used Web shells and

HTRAN for C2 and to exfiltrate data.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.005|Indicator Removal from Tools|

GALLIUM ensured each payload had a unique hash, including by using different types of packers.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows|T1550.002|Pass the Hash|

GALLIUM used dumped hashes to authenticate to other machines via pass the hash.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

GALLIUM used a modified version of

NBTscan to identify available NetBIOS name servers over the network as well as

GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|


GALLIUM used a modified version of

HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|

GALLIUM used a modified version of

HTRAN to redirect connections between networks.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

GALLIUM packed some payloads using different types of packers, both known and custom.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

GALLIUM established persistence for

PoisonIvy by created a scheduled task.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.003|Rename System Utilities|

GALLIUM used a renamed cmd.exe file to evade detection.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and

HTRAN.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

GALLIUM used

GALLIUM used

GALLIUM used

NBTscan to identify available NetBIOS name servers.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

GALLIUM used a modified version of

Mimikatz along with a PowerShell-based


GALLIUM used a modified version of

Mimikatz along with a PowerShell-based

Mimikatz to dump credentials on the victim machines.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.002|Security Account Manager|

GALLIUM used

GALLIUM used the Windows command shell to execute commands.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1136.002|Domain Account|

GALLIUM created high-privileged domain user accounts to maintain access to victim networks.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

GALLIUM leveraged valid accounts to maintain access to a victim network.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

GALLIUM used DLL side-loading to covertly load


GALLIUM used DLL side-loading to covertly load

PoisonIvy into memory on the victim machine.(Citation: Cybereason Soft Cell June 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

GALLIUM exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)|


Gallmaker - G0084

Created: 2019-01-30T14:26:42.897Z

Modified: 2020-03-30T19:04:47.798Z

Contributors:

Aliases

Gallmaker

Description

Gallmaker is a cyberespionage group that has targeted victims in the Middle East and has been active since at least December 2017. The group has mainly targeted victims in the defense, military, and government sectors.(Citation: Symantec Gallmaker Oct 2018)

Techniques Used

Gallmaker has used WinZip, likely to archive data prior to exfiltration.(Citation: Symantec Gallmaker Oct 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Gallmaker sent emails with malicious Microsoft Office documents attached.(Citation: Symantec Gallmaker Oct 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution.(Citation: Symantec Gallmaker Oct 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Gallmaker used PowerShell to download additional payloads and for execution.(Citation: Symantec Gallmaker Oct 2018)|
|mitre-attack|enterprise-attack|Windows|T1559.002|Dynamic Data Exchange|

Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.(Citation: Symantec Gallmaker Oct 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Gallmaker obfuscated shellcode used during execution.(Citation: Symantec Gallmaker Oct 2018)|


Gamaredon Group - G0047

Created: 2017-05-31T21:32:09.849Z

Modified: 2023-03-22T04:29:39.915Z

Contributors: ESET,Trend Micro Incorporated

Aliases

Gamaredon Group,IRON TILDEN,Primitive Bear,ACTINIUM,Armageddon,Shuckworm,DEV-0157

Description

Gamaredon Group is a suspected Russian cyber espionage threat group that has targeted military, NGO, judiciary, law enforcement, and non-profit organizations in Ukraine since at least 2013. The name Gamaredon Group comes from a misspelling of the word "Armageddon", which was detected in the adversary's early campaigns.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: Microsoft Actinium February 2022)

In November 2021, the Ukrainian government publicly attributed Gamaredon Group to Russia's Federal Security Service (FSB) Center 18.(Citation: Bleepingcomputer Gamardeon FSB November 2021)(Citation: Microsoft Actinium February 2022)

Techniques Used

Gamaredon Group has used obfuscated or encrypted scripts.(Citation: ESET Gamaredon June 2020)(Citation: Microsoft Actinium February 2022)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|

Gamaredon Group has tested connectivity between a compromised machine and a C2 server using

Ping with commands such as

Gamaredon Group has used

Gamaredon Group has used legitimate process names to hide malware including

Gamaredon Group has used

Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|


Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

Gamaredon Group has registered domains to stage payloads.(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Gamaredon Group has registered multiple domains to facilitate payload staging and C2.(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Gamaredon Group has used obfuscated PowerShell scripts for staging.(Citation: Microsoft Actinium February 2022)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1485|Data Destruction|

Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.(Citation: CERT-EE Gamaredon January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1491.001|Internal Defacement|

Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.(Citation: CERT-EE Gamaredon January 2021)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Gamaredon Group has used WMI to execute scripts used for discovery.(Citation: CERT-EE Gamaredon January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.(Citation: Symantec Shuckworm January 2022)(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1021.005|VNC|


Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.(Citation: Symantec Shuckworm January 2022)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

Gamaredon Group malware has used rundll32 to launch additional malicious components.(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Windows,Office 365,SaaS,Linux,macOS|T1080|Taint Shared Content|

Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1020|Automated Exfiltration|

Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Gamaredon Group malware has used

Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened.

Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the

Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments.(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|


Gamaredon Group has removed security settings for VBA macro execution by changing registry values

Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.(Citation: ESET Gamaredon June 2020)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros.

Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.(Citation: ESET Gamaredon June 2020)(Citation: Unit 42 Gamaredon February 2022)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

Gamaredon Group has obfuscated .NET executables by inserting junk code.(Citation: ESET Gamaredon June 2020)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.004|Compile After Delivery|

Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in

Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.(Citation: ESET Gamaredon June 2020)    |
|mitre-attack|enterprise-attack|Windows|T1559.001|Component Object Model|


Gamaredon Group malware can insert malicious macros into documents using a

Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|

Gamaredon Group's malware can take screenshots of the compromised computer every minute.(Citation: ESET Gamaredon June 2020)  |
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: Secureworks IRON TILDEN Profile)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: Secureworks IRON TILDEN Profile)|
|mitre-attack|enterprise-attack|Windows|T1221|Template Injection|

Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads.(Citation: Proofpoint RTF Injection)


Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads.(Citation: Proofpoint RTF Injection)

Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Unit 42 Gamaredon February 2022)(Citation: Secureworks IRON TILDEN Profile)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Gamaredon Group has embedded malicious macros in document templates, which executed VBScript.

Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Microsoft Actinium February 2022)(Citation: Secureworks IRON TILDEN Profile)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Gamaredon Group tools decrypted additional payloads from the C2.

Gamaredon Group has also decoded base64-encoded source code of a downloader.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|


Gamaredon Group tools can delete files used during an operation.(Citation: TrendMicro Gamaredon April 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1120|Peripheral Device Discovery|

Gamaredon Group tools have contained an application to check performance of USB flash drives.

Gamaredon Group has also used malware to scan for removable drives.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|A

Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.(Citation: Palo Alto Gamaredon Feb 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1025|Data from Removable Media|A

Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Gamaredon Group has used HTTP and HTTPS for C2 communications.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Symantec Shuckworm January 2022)(Citation: CERT-EE Gamaredon January 2021)(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Gamaredon Group has used various batch scripts to establish C2 and download additional files.


Gamaredon Group has used various batch scripts to establish C2 and download additional files.

Gamaredon Group's backdoor malware has also been written to a batch file.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: ESET Gamaredon June 2020)(Citation: CERT-EE Gamaredon January 2021)(Citation: Unit 42 Gamaredon February 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|A

Gamaredon Group file stealer can gather the victim's username to send to a C2 server.(Citation: Palo Alto Gamaredon Feb 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Gamaredon Group has downloaded additional malware and tools onto a compromised host.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: ESET Gamaredon June 2020)(Citation: Microsoft Actinium February 2022)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|A

Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.(Citation: Palo Alto Gamaredon Feb 2017)(Citation: TrendMicro Gamaredon April 2020)(Citation: CERT-EE Gamaredon January 2021)|


GCMAN - G0036

Created: 2017-05-31T21:32:05.611Z

Modified: 2020-03-30T19:03:44.853Z

Contributors:

Aliases

GCMAN

Description

GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services. (Citation: Securelist GCMAN)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1021.005|VNC|GCMAN uses VNC for lateral movement.(Citation: Securelist GCMAN)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|GCMAN uses Putty for lateral movement.(Citation: Securelist GCMAN)|


GOLD SOUTHFIELD - G0115

Created: 2020-09-22T19:41:27.845Z

Modified: 2023-03-28T20:49:53.223Z

Contributors: Thijn Bukkems, Amazon

Aliases

GOLD SOUTHFIELD,Pinchy Spider

Description

GOLD SOUTHFIELD is a financially motivated threat group active since at least 2018 that operates the REvil Ransomware-as-a Service (RaaS). GOLD SOUTHFIELD provides backend infrastructure for affiliates recruited on underground forums to perpetrate high value deployments. By early 2020, GOLD SOUTHFIELD started capitalizing on the new trend of stealing data and further extorting the victim to pay for their data to not get publicly leaked.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)(Citation: CrowdStrike Evolution of Pinchy Spider July 2021)

Techniques Used

GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts.(Citation: Tetra Defense Sodinokibi March 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.(Citation: Tetra Defense Sodinokibi March 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1113|Screen Capture|

GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.(Citation: Tetra Defense Sodinokibi March 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1219|Remote Access Software|

GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy

REvil.(Citation: Tetra Defense Sodinokibi March 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1195.002|Compromise Software Supply Chain|


GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.(Citation: Secureworks REvil September 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: Secureworks GOLD SOUTHFIELD)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.(Citation: Secureworks REvil September 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,SaaS,Office 365,Google Workspace|T1566|Phishing|

GOLD SOUTHFIELD has conducted malicious spam (malspam) campaigns to gain access to victim's machines.(Citation: Secureworks REvil September 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|

GOLD SOUTHFIELD has breached Managed Service Providers (MSP's) to deliver malware to MSP customers.(Citation: Secureworks REvil September 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring (RMM) servers to gain access to victim machines.(Citation: Secureworks REvil September 2019)    |


Gorgon Group - G0078

Created: 2018-10-17T00:14:20.652Z

Modified: 2021-10-12T21:57:25.847Z

Contributors:

Aliases

Gorgon Group

Description

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)

Techniques Used

Gorgon Group has obtained and used tools such as

QuasarRAT and

Remcos.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

Gorgon Group has used

PowerShell windows by setting the WindowStyle parameter to hidden. (Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Gorgon Group malware can download additional files from C2 servers.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.002|Portable Executable Injection|

Gorgon Group malware can download a remote access tool,

ShiftyBug, and inject into another process.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.012|Process Hollowing|


ShiftyBug, and inject into another process.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.012|Process Hollowing|

Gorgon Group malware can use process hollowing to inject one of its trojans into another process.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Gorgon Group has used macros in

Spearphishing Attachments as well as executed VBScripts on victim machines.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the

Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.009|Shortcut Modification|

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|


Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under


Group5 - G0043

Created: 2017-05-31T21:32:08.304Z

Modified: 2020-03-30T19:07:39.812Z

Contributors:

Aliases

Group5

Description

Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. Group5 has used two commonly available remote access tools (RATs), njRAT and NanoCore, as well as an Android RAT, DroidJack. (Citation: Citizen Lab Group5)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.(Citation: Citizen Lab Group5)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|Malware used by Group5 is capable of remotely deleting files from victims.(Citation: Citizen Lab Group5)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|Malware used by Group5 is capable of watching the victim's screen.(Citation: Citizen Lab Group5)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|Malware used by Group5 is capable of capturing keystrokes.(Citation: Citizen Lab Group5)|


HAFNIUM - G0125

Created: 2021-03-03T19:40:47.280Z

Modified: 2023-04-10T21:54:46.756Z

Contributors: Daniyal Naeem, BT Security,Matt Brenton, Zurich Insurance Group,Mayuresh Dani, Qualys,Harshal Tupsamudre, Qualys,Vinayak Wadhwa, SAFE Security

Aliases

HAFNIUM,Operation Exchange Marauder

Description

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)

Techniques Used

HAFNIUM has collected data and files from a compromised machine.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|

HAFNIUM has hidden files on a compromised host.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

HAFNIUM has searched file contents on a compromised host.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

HAFNIUM has collected IP information via IPInfo.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|

HAFNIUM has checked for network connectivity from a compromised host using

HAFNIUM has used

HAFNIUM has used

HAFNIUM has enumerated domain controllers using


HAFNIUM has checked for network connectivity from a compromised host using

HAFNIUM has used

HAFNIUM has used

HAFNIUM has enumerated domain controllers using

HAFNIUM has granted privileges to domain accounts.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

HAFNIUM has used

HAFNIUM has used

HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.(Citation: Microsoft HAFNIUM March 2020)(Citation: Rapid7 HAFNIUM Mar 2021) |
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|

HAFNIUM has used TCP for C2.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

HAFNIUM has used ASCII encoding for C2 traffic.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.(Citation: FireEye Exchange Zero Days March 2021)|
|mitre-attack|enterprise-attack|PRE|T1590.005|IP Addresses|

HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1136.002|Domain Account|

HAFNIUM has created domain accounts.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|PRE|T1590|Gather Victim Network Information|


HAFNIUM has created domain accounts.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|PRE|T1590|Gather Victim Network Information|

HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.003|NTDS|

HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

HAFNIUM has collected e-mail addresses for users they intended to target.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

HAFNIUM has used the Exchange Power Shell module

HAFNIUM has used web shells to export mailbox data.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

HAFNIUM has used

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL,

China Chopper, and


HAFNIUM has used

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL,

China Chopper, and

ASPXSpy.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)(Citation: FireEye Exchange Zero Days March 2021)(Citation: Tarrask scheduled task)(Citation: Rapid7 HAFNIUM Mar 2021)   |
|mitre-attack|enterprise-attack|PRE|T1583.003|Virtual Private Server|

HAFNIUM has operated from leased virtual private servers (VPS) in the United States.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|PRE|T1592.004|Client Configurations|

HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

HAFNIUM has exfiltrated data to file sharing sites, including MEGA.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

HAFNIUM has used open-source C2 frameworks, including Covenant.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

HAFNIUM has acquired web services for use in C2 and exfiltration.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|


HAFNIUM has exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065  to compromise on-premises versions of Microsoft Exchange Server, enabling access to email accounts and installation of additional malware.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)(Citation: FireEye Exchange Zero Days March 2021)(Citation: Tarrask scheduled task)   |


HEXANE - G1001

Created: 2018-10-17T00:14:20.652Z

Modified: 2023-03-22T04:43:59.082Z

Contributors: Dragos Threat Intelligence,Mindaugas Gudzis, BT Security

Aliases

HEXANE,Lyceum,Siamesekitten,Spirlin

Description

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)

Techniques Used

HEXANE has acquired, and sometimes customized, open source tools such as

Mimikatz,

Empire, VNC remote access software, and DIG.net.(Citation: Kaspersky Lyceum October 2021)(Citation: SecureWorks August 2019)(Citation: Zscaler Lyceum DnsSystem June 2022)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

HEXANE has enumerated programs installed on an infected machine.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

HEXANE has collected the hostname of a compromised machine.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|


HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

HEXANE has used cloud services, including OneDrive, for C2.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

HEXANE has used cloud services, including OneDrive, for data exfiltration.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.002|DNS Server|

HEXANE has set up custom DNS servers to send commands to compromised hosts via TXT records.(Citation: Zscaler Lyceum DnsSystem June 2022)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

HEXANE has used

HEXANE has used

Ping and

HEXANE has used

netstat to monitor connections to specific ports.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|

HEXANE has used tools including

BITSAdmin to test internet connectivity from compromised hosts.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

HEXANE has used a scheduled task to establish persistence for a keylogger.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

HEXANE has used a VisualBasic script named

HEXANE has used a


HEXANE has used a VisualBasic script named

HEXANE has used a

Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

HEXANE has enumerated processes on targeted systems.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1069.001|Local Groups|

HEXANE has run

HEXANE has run

HEXANE has run

HEXANE has established email accounts for use in domain registration including for ProtonMail addresses.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

HEXANE has used Base64-encoded scripts.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1608.001|Upload Malware|

HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1585.001|Social Media Accounts|

HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Office 365,SaaS,Google Workspace|T1534|Internal Spearphishing|

HEXANE has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1589|Gather Victim Identity Information|


HEXANE has identified specific potential victims at targeted organizations.(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1591.004|Identify Roles|

HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.(Citation: SecureWorks August 2019)(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.001|Domains|

HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.(Citation: SecureWorks August 2019)(Citation: Dragos Hexane)(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1589.002|Email Addresses|

HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.(Citation: SecureWorks August 2019)(Citation: ClearSky Siamesekitten August 2021)
|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.001|Remote Desktop Protocol|

HEXANE has used remote desktop sessions for lateral movement.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1010|Application Window Discovery|

HEXANE has used a PowerShell-based keylogging tool to capture the window title.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

HEXANE has used a PowerShell-based keylogger named

HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.(Citation: SecureWorks August 2019)(Citation: Kaspersky APT Trends Q1 April 2021)(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|


HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.(Citation: SecureWorks August 2019)(Citation: Dragos Hexane)(Citation: ClearSky Siamesekitten August 2021)(Citation: Zscaler Lyceum DnsSystem June 2022)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1586.002|Email Accounts|

HEXANE has used compromised accounts to send spearphishing emails.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

HEXANE has used brute force attacks to compromise valid credentials.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1110.003|Password Spraying|

HEXANE has used password spraying attacks to obtain valid credentials.(Citation: SecureWorks August 2019)|


Higaisa - G0126

Created: 2021-03-05T18:54:56.267Z

Modified: 2021-04-22T02:12:43.892Z

Contributors: Daniyal Naeem, BT Security

Aliases

Higaisa

Description

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)(Citation: PTSecurity Higaisa 2020)

Techniques Used

Higaisa has used VBScript code on the victim's machine.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Higaisa has called various native OS APIs.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the

Higaisa used a payload that creates a hidden window.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Higaisa’s shellcode attempted to find the process ID of the current process.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1029|Scheduled Transfer|

Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|


Higaisa collected the system volume serial number, GUID, and computer name.(Citation: PTSecurity Higaisa 2020)(Citation: Malwarebytes Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Higaisa has exploited CVE-2018-0798 for execution.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Higaisa used malicious e-mail attachments to lure victims into executing LNK files.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Higaisa dropped and added

Higaisa has sent spearphishing emails containing malicious attachments.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020) |
|mitre-attack|enterprise-attack|Windows,Network|T1124|System Time Discovery|

Higaisa used a function to gather the current time.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Higaisa added a spoofed binary to the start-up folder for persistence.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Higaisa used

Higaisa used JavaScript to execute additional files.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Higaisa named a shellcode loader binary


Higaisa named a shellcode loader binary

Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1220|XSL Script Processing|

Higaisa used an XSL file to run VBScript code.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Higaisa used Base64 encoded compressed payloads.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.001|Internal Proxy|

Higaisa discovered system proxy settings and used them if available.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Higaisa used HTTP and HTTPS to send data back to its C2 server.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1001.003|Protocol Impersonation|

Higaisa used a FakeTLS session for C2 communications.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

Higaisa used AES-128 to encrypt C2 traffic.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Higaisa used


Higaisa used

Higaisa exfiltrated data over its C2 channel.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

Higaisa performed padding with null bytes before calculating its hash.(Citation: Zscaler Higaisa 2020)|


Inception - G0100

Created: 2020-05-08T17:01:04.058Z

Modified: 2021-10-12T23:21:06.480Z

Contributors: Oleg Skulkin, Group-IB

Aliases

Inception,Inception Framework,Cloud Atlas

Description

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.(Citation: Unit 42 Inception November 2018)(Citation: Symantec Inception Framework March 2018)(Citation: Kaspersky Cloud Atlas December 2014)

Techniques Used

Inception has obtained and used open-source tools such as

LaZagne.(Citation: Kaspersky Cloud Atlas August 2019)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Inception has enumerated installed software on compromised systems.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

Inception has used malicious HTA files to drop and execute malware.(Citation: Kaspersky Cloud Atlas August 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.(Citation: Kaspersky Cloud Atlas August 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Inception has used PowerShell to execute malicious commands and payloads.(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas December 2014)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|


Inception has used VBScript to execute malicious commands and payloads.(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas December 2014)|
|mitre-attack|enterprise-attack|Windows|T1221|Template Injection|

Inception has used decoy documents to load malicious remote payloads via HTTP.(Citation: Unit 42 Inception November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.(Citation: Kaspersky Cloud Atlas December 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Inception used a file listing plugin to collect information about file and directories both on local and remote drives.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.(Citation: Kaspersky Cloud Atlas August 2019)(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Symantec Inception Framework March 2018)(Citation: Unit 42 Inception November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Inception has used HTTP, HTTPS, and WebDav in network communications.(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Unit 42 Inception November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|


Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Kaspersky Cloud Atlas August 2019)(Citation: Symantec Inception Framework March 2018)(Citation: Unit 42 Inception November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090.003|Multi-hop Proxy|

Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Inception has maintained persistence by modifying Registry run key value

Inception has encrypted network communications with AES.(Citation: Kaspersky Cloud Atlas December 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1069.002|Domain Groups|

Inception has used specific malware modules to gather domain membership.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

Inception has ensured persistence at system boot by setting the value

Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Inception has used a reconnaissance module to identify active processes and other associated loaded modules.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|


Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Symantec Inception Framework March 2018)(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas August 2019)|


IndigoZebra - G0136

Created: 2021-09-24T21:41:34.797Z

Modified: 2021-10-16T02:06:06.404Z

Contributors: Pooja Natarajan, NEC Corporation India,Yoshihiro Kori, NEC Corporation,Manikantan Srinivasan, NEC Corporation India

Aliases

IndigoZebra

Description

IndigoZebra is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)(Citation: Securelist APT Trends Q2 2017)

Techniques Used

IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.(Citation: Checkpoint IndigoZebra July 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.(Citation: Checkpoint IndigoZebra July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

IndigoZebra has downloaded additional files and tools from its C2 server.(Citation: Checkpoint IndigoZebra July 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

IndigoZebra has acquired open source tools such as

NBTscan and Meterpreter for their operations.(Citation: Checkpoint IndigoZebra July 2021)(Citation: Securelist APT Trends Q2 2017) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.(Citation: HackerNews IndigoZebra July 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|


IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

IndigoZebra created Dropbox accounts for their operations.(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)|


Indrik Spider - G0119

Created: 2021-01-06T17:46:35.134Z

Modified: 2022-09-15T19:49:18.799Z

Contributors:

Aliases

Indrik Spider,Evil Corp

Description

Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)

Techniques Used

Indrik Spider has stored collected date in a .tmp file.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Indrik Spider has attempted to get users to click on a malicious zipped file.(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows|T1070.001|Clear Windows Event Logs|

Indrik Spider has used

Cobalt Strike to empty log files.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1489|Service Stop|

Indrik Spider has used

PsExec to stop services prior to the execution of ransomware.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|


Indrik Spider has used malicious JavaScript files for several components of their attack.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Indrik Spider used

Cobalt Strike to carry out credential dumping using ProcDump.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,IaaS,Linux,macOS,Google Workspace,Network|T1136|Create Account|

Indrik Spider used

Indrik Spider used

PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Indrik Spider has used WMIC to execute commands on remote computers.(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Indrik Spider has used batch scripts on victim's machines.(Citation: Crowdstrike Indrik November 2018) |
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Indrik Spider has used PowerShell

Empire for execution of malware.(Citation: Crowdstrike Indrik November 2018)(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

Indrik Spider has collected credentials from infected systems, including domain accounts.(Citation: Crowdstrike Indrik November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|


Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.(Citation: Crowdstrike Indrik November 2018)(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.(Citation: Crowdstrike Indrik November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS|T1486|Data Encrypted for Impact|

Indrik Spider has encrypted domain-controlled systems using

BitPaymer.(Citation: Crowdstrike Indrik November 2018)|
|mitre-attack|enterprise-attack|Windows|T1484.001|Group Policy Modification|

Indrik Spider has used Group Policy Objects to deploy batch scripts.(Citation: Crowdstrike Indrik November 2018)|
|mitre-attack|enterprise-attack|PRE|T1584.004|Server|

Indrik Spider has served fake updates via legitimate websites that have been compromised.(Citation: Crowdstrike Indrik November 2018) |


Ke3chang - G0004

Created: 2017-05-31T21:31:47.177Z

Modified: 2022-07-22T18:52:32.762Z

Contributors: Pooja Natarajan, NEC Corporation India,Manikantan Srinivasan, NEC Corporation India,Hiroki Nagahama, NEC Corporation

Aliases

Ke3chang,APT15,Mirage,Vixen Panda,GREF,Playful Dragon,RoyalAPT,NICKEL

Description

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)

Techniques Used

Ke3chang has used implants to collect the system language ID of a compromised machine.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Azure AD,Office 365,SaaS,IaaS,Google Workspace|T1078.004|Cloud Accounts|

Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Ke3chang has used tools to download files to compromised machines.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1020|Automated Exfiltration|

Ke3chang has performed  frequent and scheduled data exfiltration from compromised networks.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|