TA551 has used spoofed company emails that were acquired from email clients on previously infected hosts to target other individuals.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

TA551 has retrieved DLLs and installer binaries for malware execution from C2.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

TA551 has hidden encoded data for malware DLLs in a PNG.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

TA551 has used HTTP for C2 communications.(Citation: Unit 42 Valak July 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

TA551 has used rundll32.exe to load malicious DLLs.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

TA551 has used regsvr32.exe to load malicious DLLs.(Citation: Unit 42 Valak July 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

TA551 has used encoded ASCII text for initial C2 communications.(Citation: Unit 42 Valak July 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

TA551 has masked malware DLLs as dat and jpg files.(Citation: Unit 42 TA551 Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

TA551 has used obfuscated variable names in a JavaScript configuration file.(Citation: Unit 42 Valak July 2020)|


TeamTNT - G0139

Created: 2021-10-01T01:57:31.229Z

Modified: 2022-10-19T21:35:03.147Z

Contributors: Will Thomas, Cyjax,Darin Smith, Cisco

Aliases

TeamTNT

Description

TeamTNT is a threat group that has primarily targeted cloud and containerized environments. The group as been active since at least October 2019 and has mainly focused its efforts on leveraging cloud and container resources to deploy cryptocurrency miners in victim environments.(Citation: Palo Alto Black-T October 2020)(Citation: Lacework TeamTNT May 2021)(Citation: Intezer TeamTNT September 2020)(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard Malware)(Citation: Trend Micro TeamTNT)(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Aqua TeamTNT August 2020)(Citation: Intezer TeamTNT Explosion September 2021)

Techniques Used

TeamTNT has leveraged AWS CLI to enumerate cloud environments with compromised credentials.(Citation: Talos TeamTNT)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1569|System Services|

TeamTNT has created system services to execute cryptocurrency mining software.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

TeamTNT has used a script that decodes a Base64-encoded version of WeaveWorks Scope.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

TeamTNT has used a script that checks

TeamTNT has sent locally staged files with collected credentials to C2 servers using cURL.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|


TeamTNT has aggregated collected credentials in text files before exfiltrating.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

TeamTNT has searched for services such as Alibaba Cloud Security's aliyun service and BMC Helix Cloud Security's bmc-agent service in order to disable them.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1120|Peripheral Device Discovery|

TeamTNT has searched for attached VGA devices using lspci.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

TeamTNT has replaced .dockerd and .dockerenv with their own scripts and cryptocurrency mining software.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

TeamTNT has disguised their scripts with docker-related file names.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1552.004|Private Keys|

TeamTNT has searched for unsecured SSH keys.(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Trend Micro TeamTNT)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

TeamTNT has the

TeamTNT has developed custom malware such as

Hildegard.(Citation: Unit 42 Hildegard Malware)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers|T1611|Escape to Host|

TeamTNT has deployed privileged containers that mount the filesystem of victim machine.(Citation: Intezer TeamTNT September 2020)(Citation: Aqua TeamTNT August 2020)|
|mitre-attack|enterprise-attack|Containers|T1609|Container Administration Command|

TeamTNT executed


TeamTNT executed

Hildegard through the kubelet API run command and by executing commands on running containers.(Citation: Unit 42 Hildegard Malware)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

TeamTNT has used open-source tools such as Weave Scope to target exposed Docker API ports and gain initial access to victim environments.(Citation: Intezer TeamTNT September 2020)(Citation: Cisco Talos Intelligence Group)

TeamTNT has also targeted exposed kubelets for Kubernetes environments.(Citation: Unit 42 Hildegard Malware)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

TeamTNT has used SSH to connect back to victim machines.(Citation: Intezer TeamTNT September 2020)

TeamTNT has also used SSH to transfer tools and payloads onto victim hosts and execute them.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1496|Resource Hijacking|

TeamTNT has deployed XMRig Docker images to mine cryptocurrency.(Citation: Lacework TeamTNT May 2021)(Citation: Cado Security TeamTNT Worm August 2020)

TeamTNT has also infected Docker containers and Kubernetes clusters with XMRig, and used RainbowMiner and lolMiner for mining cryptocurrency.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

TeamTNT has uploaded backdoored Docker images to Docker Hub.(Citation: Lacework TeamTNT May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

TeamTNT has created local privileged users on victim machines.(Citation: Intezer TeamTNT September 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|


TeamTNT has used masscan to search for open Docker API ports and Kubernetes clusters.(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Unit 42 Hildegard Malware)(Citation: Cisco Talos Intelligence Group)

TeamTNT has also used malware that utilizes zmap and zgrab to search for vulnerable services in cloud environments.(Citation: Palo Alto Black-T October 2020)|
|mitre-attack|enterprise-attack|IaaS,Containers|T1204.003|Malicious Image|

TeamTNT has relied on users to download and execute malicious Docker images.(Citation: Lacework TeamTNT May 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|

TeamTNT has searched for unsecured AWS credentials and Docker API credentials.(Citation: Cado Security TeamTNT Worm August 2020)(Citation: Trend Micro TeamTNT)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

TeamTNT has established tmate sessions for C2 communications.(Citation: Unit 42 Hildegard Malware)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

TeamTNT has obtained domains to host their payloads.(Citation: Palo Alto Black-T October 2020)|
|mitre-attack|enterprise-attack|Containers|T1610|Deploy Container|

TeamTNT has deployed different types of containers into victim environments to facilitate execution.(Citation: Intezer TeamTNT September 2020)(Citation: Trend Micro TeamTNT)

TeamTNT has also transferred cryptocurrency mining software to Kubernetes clusters discovered within local IP address ranges.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

TeamTNT has the


TeamTNT has the

TeamTNT has also used a custom user agent HTTP header in shell scripts.(Citation: Trend Micro TeamTNT)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1070.003|Clear Command History|

TeamTNT has cleared command history with

TeamTNT has run

TeamTNT has also used

TeamTNT has checked for running containers with

TeamTNT has also searched for Kubernetes pods running in a local network.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|PRE|T1595.001|Scanning IP Blocks|

TeamTNT has scanned specific lists of target IP addresses.(Citation: Trend Micro TeamTNT)|
|mitre-attack|enterprise-attack|IaaS|T1552.005|Cloud Instance Metadata API|

TeamTNT has queried the AWS instance metadata service for credentials.(Citation: Trend Micro TeamTNT)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux|T1543.002|Systemd Service|

TeamTNT has established persistence through the creation of a cryptocurrency mining system service using

TeamTNT has encrypted its binaries via AES and encoded files using Base64.(Citation: Trend Micro TeamTNT)(Citation: Aqua TeamTNT August 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

TeamTNT has searched for rival malware and removes it if found.(Citation: Trend Micro TeamTNT)

TeamTNT has also searched for running processes containing the strings aliyun or liyun to identify machines running Alibaba Cloud Security tools.(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|

TeamTNT has scanned for vulnerabilities in IoT devices and other related resources such as the Docker API.(Citation: Trend Micro TeamTNT)|
|mitre-attack|enterprise-attack|macOS,Linux|T1222.002|Linux and Mac File and Directory Permissions Modification|

TeamTNT has modified the permissions on binaries with


TeamTNT has modified the permissions on binaries with

TeamTNT has enumerated the host machine’s IP address.(Citation: Trend Micro TeamTNT)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1014|Rootkit|

TeamTNT has used rootkits such as the open-source Diamorphine rootkit and their custom bots to hide cryptocurrency mining activities on the machine.(Citation: Trend Micro TeamTNT) (Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

TeamTNT has used UPX and Ezuri packer to pack its binaries.(Citation: Trend Micro TeamTNT)|
|mitre-attack|enterprise-attack|macOS,Linux|T1059.004|Unix Shell|

TeamTNT has used shell scripts for execution.(Citation: Trend Micro TeamTNT)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

TeamTNT has used malware that adds cryptocurrency miners as a service.(Citation: ATT TeamTNT Chimaera September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071|Application Layer Protocol|

TeamTNT has used an IRC bot for C2 communications.(Citation: Trend Micro TeamTNT)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

TeamTNT has used batch scripts to download tools and executing cryptocurrency miners.(Citation: ATT TeamTNT Chimaera September 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

TeamTNT has executed PowerShell commands in batch scripts.(Citation: ATT TeamTNT Chimaera September 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|


TeamTNT has added batch scripts to the startup folder.(Citation: ATT TeamTNT Chimaera September 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

TeamTNT has searched for security products on infected machines.(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

TeamTNT has searched for system version, architecture, disk partition, logical volume, and hostname information.(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

TeamTNT has disabled and uninstalled security tools such as Alibaba, Tencent, and BMC cloud monitoring agents on cloud-based infrastructure.(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

TeamTNT has used a payload that removes itself after running.

TeamTNT also has deleted locally staged files for collecting credentials or scan results for local IP addresses after exfiltrating them.(Citation: ATT TeamTNT Chimaera September 2020)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,macOS,IaaS,Network|T1098.004|SSH Authorized Keys|

TeamTNT has added RSA keys in

TeamTNT has leveraged iplogger.org to send collected data back to C2.(Citation: Aqua TeamTNT August 2020)(Citation: Cisco Talos Intelligence Group)|
|mitre-attack|enterprise-attack|Linux,macOS|T1070.002|Clear Linux or Mac System Logs|

TeamTNT has removed system logs from

TeamTNT has disabled


TEMP.Veles - G0088

Created: 2019-04-16T15:14:38.533Z

Modified: 2022-11-30T22:46:40.135Z

Contributors: Dragos  Threat  Intelligence

Aliases

TEMP.Veles,XENOTIME

Description

TEMP.Veles is a Russia-based threat group that has targeted critical infrastructure. The group has been observed utilizing TRITON, a malware framework designed to manipulate industrial safety systems.(Citation: FireEye TRITON 2019)(Citation: FireEye TEMP.Veles 2018)(Citation: FireEye TEMP.Veles JSON April 2019)

Techniques Used

TEMP.Veles has obtained and used tools such as

Mimikatz and

PsExec.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.003|Virtual Private Server|

TEMP.Veles has used Virtual Private Server (VPS) infrastructure.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

TEMP.Veles has used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027.005|Indicator Removal from Tools|

TEMP.Veles has modified files based on the open-source project cryptcat in an apparent attempt to decrease AV detection rates.(Citation: FireEye TEMP.Veles 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|

TEMP.Veles has used a publicly-available PowerShell-based tool, WMImplant.(Citation: FireEye TEMP.Veles 2018) The group has also used PowerShell to perform


TEMP.Veles has used a publicly-available PowerShell-based tool, WMImplant.(Citation: FireEye TEMP.Veles 2018) The group has also used PowerShell to perform

Timestomping.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

TEMP.Veles has planted Web shells on Outlook Exchange servers.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

TEMP.Veles has used a VPN to persist in the victim environment.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.001|Remote Desktop Protocol|

TEMP.Veles utilized RDP throughout an operation.(Citation: FireEye TRITON 2019)   |
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

TEMP.Veles has used compromised VPN accounts.(Citation: FireEye TRITON 2019) |
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS|T1021.004|SSH|

TEMP.Veles has relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

TEMP.Veles has created staging folders in directories that were infrequently used by legitimate users or processes.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.004|File Deletion|


TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.006|Timestomp|

TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

TEMP.Veles has used scheduled task XML triggers.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1546.012|Image File Execution Options Injection|

TEMP.Veles has modified and added entries within

TEMP.Veles has used

Mimikatz and a custom tool, SecHack, to harvest credentials. (Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

TEMP.Veles has renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.(Citation: FireEye TRITON 2019)
|
|mitre-attack|enterprise-attack,ics-attack|Engineering Workstation,Human-Machine Interface,Control Server|T0886|Remote Services|

TEMP.Veles utilized remote desktop protocol (RDP) jump boxes to move into the ICS environment. (Citation: Dragos December 2017)|
|mitre-attack|enterprise-attack,ics-attack|None|T0817|Drive-by Compromise|

TEMP.Veles utilizes watering hole websites to target industrial employees. (Citation: Chris Bing May 2018)|
|mitre-attack|enterprise-attack,ics-attack|Control Server,Data Historian,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0862|Supply Chain Compromise|


TEMP.Veles targeted several ICS vendors and manufacturers. (Citation: Dragos Threat Intelligence August 2019)|
|mitre-attack|enterprise-attack,ics-attack|Control Server,Data Historian,Engineering Workstation,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0859|Valid Accounts|

TEMP.Veles used valid credentials when laterally moving through RDP jump boxes into the ICS environment. (Citation: Dragos December 2017)|


The White Company - G0089

Created: 2019-05-02T00:08:18.314Z

Modified: 2020-03-30T19:24:52.290Z

Contributors:

Aliases

The White Company

Description

The White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.(Citation: Cylance Shaheen Nov 2018)

Techniques Used

The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

The White Company has used phishing lure documents that trick users into opening them and infecting their computers.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

The White Company has obfuscated their payloads through packing.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

The White Company has the ability to delete its malware entirely from the target system.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|


The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Windows,Network|T1124|System Time Discovery|

The White Company has checked the current date on the victim system.(Citation: Cylance Shaheen Nov 2018)|


Threat Group-1314 - G0028

Created: 2017-05-31T21:31:59.120Z

Modified: 2020-03-19T21:58:20.831Z

Contributors:

Aliases

Threat Group-1314,TG-1314

Description

Threat Group-1314 is an unattributed threat group that has used compromised credentials to log into a victim's remote access infrastructure. (Citation: Dell TG-1314)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.(Citation: Dell TG-1314)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|Threat Group-1314 actors mapped network drives using net use.(Citation: Dell TG-1314)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.(Citation: Dell TG-1314)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1072|Software Deployment Tools|Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.(Citation: Dell TG-1314)|


Threat Group-3390 - G0027

Created: 2017-05-31T21:31:58.518Z

Modified: 2023-03-29T16:53:17.235Z

Contributors: Daniyal Naeem, BT Security,Kyaw Pyiyt Htet, @KyawPyiytHtet

Aliases

Threat Group-3390,Earth Smilodon,TG-3390,Emissary Panda,BRONZE UNION,APT27,Iron Tiger,LuckyMouse

Description

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Trend Micro DRBControl February 2020)

Techniques Used

Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.(Citation: Lunghi Iron Tiger Linux)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Threat Group-3390 has registered domains for C2.(Citation: Lunghi Iron Tiger Linux)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.(Citation: Trend Micro Iron Tiger April 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.005|Password Managers|

Threat Group-3390 obtained a KeePass database from a compromised host.(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|


Threat Group-3390 has used

Threat Group-3390 has packed malware and tools, including using VMProtect.(Citation: Trend Micro DRBControl February 2020)(Citation: Trend Micro Iron Tiger April 2021)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

Threat Group-3390 has hosted malicious payloads on Dropbox.(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

Threat Group-3390 has exfiltrated stolen data to Dropbox.(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1195.002|Compromise Software Supply Chain|

Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.(Citation: Trend Micro Iron Tiger April 2021)|
|mitre-attack|enterprise-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|

Threat Group-3390 has compromised third party service providers to gain access to victim's environments.(Citation: Profero APT27 December 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Threat Group-3390 has used e-mail to deliver malicious attachments to victims.(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Threat Group-3390 has lured victims into opening malicious files containing malware.(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Threat Group-3390 has obtained and used tools such as

Impacket,

pwdump,

Mimikatz,

gsecdump,

NBTscan, and


Threat Group-3390 has obtained and used tools such as

Impacket,

pwdump,

Mimikatz,

gsecdump,

NBTscan, and

Windows Credential Editor.(Citation: Unit42 Emissary Panda May 2019)(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|PRE|T1608.002|Upload Tool|

Threat Group-3390 has staged tools, including

gsecdump and WCE, on previously compromised websites.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|PRE|T1608.004|Drive-by Target|

Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.(Citation: Gallagher 2015)|
|mitre-attack|enterprise-attack|Windows|T1003.002|Security Account Manager|

Threat Group-3390 actors have used

gsecdump to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Threat Group-3390 actors have used a modified version of

Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|

Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with

China Chopper prior to exfiltration.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|


Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.(Citation: Trend Micro Iron Tiger April 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.(Citation: Unit42 Emissary Panda May 2019)    |
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Threat Group-3390 has used a variety of Web shells.(Citation: Unit42 Emissary Panda May 2019)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Lunghi Iron Tiger Linux)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|A

Threat Group-3390 tool can read and decrypt stored Registry values.(Citation: Nccgroup Emissary Panda May 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Threat Group-3390's malware can add a Registry key to

Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.(Citation: Nccgroup Emissary Panda May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|A

Threat Group-3390 tool can encrypt payloads using XOR.

Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)(Citation: Unit42 Emissary Panda May 2019)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|A


Threat Group-3390 tool has created new Registry keys under

Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.(Citation: Securelist LuckyMouse June 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Threat Group-3390 has extensively used strategic web compromises to target victims.(Citation: Dell TG-3390)(Citation: Securelist LuckyMouse June 2018)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Threat Group-3390 has performed DLL search order hijacking to execute their payload.(Citation: Nccgroup Emissary Panda May 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.012|Process Hollowing|A

Threat Group-3390 tool can spawn

Threat Group-3390 tool can use WMI to execute a binary.(Citation: Nccgroup Emissary Panda May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Threat Group-3390 has used the

Threat Group-3390 malware has used HTTP for C2.(Citation: Securelist LuckyMouse June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Threat Group-3390 actors use

NBTscan to discover vulnerable systems.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|


Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Profero APT27 December 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Threat Group-3390 has used command-line interfaces for execution.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Unit42 Emissary Panda May 2019)|
|mitre-attack|enterprise-attack|Windows|T1562.002|Disable Windows Event Logging|

Threat Group-3390 has used appcmd.exe to disable logging on a victim server.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows|T1070.005|Network Share Connection Removal|

Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Threat Group-3390 has used PowerShell for execution.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Threat Group-3390 has used

Threat Group-3390 has used

Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.006|Windows Remote Management|

Threat Group-3390 has used WinRM to enable remote execution.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|


Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services.(Citation: Dell TG-3390)

Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.002|Archive via Library|

Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1030|Data Transfer Size Limits|

Threat Group-3390 actors have split RAR files for exfiltration into parts.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Threat Group-3390 has downloaded additional malware and tools, including through the use of


Threat Group-3390 has downloaded additional malware and tools, including through the use of

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.(Citation: Dell TG-3390)(Citation: Unit42 Emissary Panda May 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.004|LSA Secrets|

Threat Group-3390 actors have used

gsecdump to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers.

Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.(Citation: Dell TG-3390)(Citation: Hacker News LuckyMouse June 2018)(Citation: Securelist LuckyMouse June 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1053.002|At|

Threat Group-3390 actors use

at to schedule tasks to run self-extracting RAR archives, which install

HTTPBrowser or

PlugX on other victims on a network.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as


Thrip - G0076

Created: 2018-10-17T00:14:20.652Z

Modified: 2021-10-12T20:13:42.274Z

Contributors:

Aliases

Thrip

Description

Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as "living off the land" techniques. (Citation: Symantec Thrip June 2018)

Techniques Used

Thrip has obtained and used tools such as

Mimikatz and

PsExec.(Citation: Symantec Thrip June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1048.003|Exfiltration Over Unencrypted Non-C2 Protocol|

Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.(Citation: Symantec Thrip June 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

Thrip used a cloud-based remote access software called LogMeIn for their attacks.(Citation: Symantec Thrip June 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.(Citation: Symantec Thrip June 2018)|


Tonto Team - G0131

Created: 2021-05-05T17:18:25.987Z

Modified: 2022-01-27T17:51:41.433Z

Contributors:

Aliases

Tonto Team,Earth Akhlut,BRONZE HUNTLEY,CactusPete,Karma Panda

Description

Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).(Citation: Kaspersky CactusPete Aug 2020)(Citation: ESET Exchange Mar 2021)(Citation: FireEye Chinese Espionage October 2019)(Citation: ARS Technica China Hack SK April 2017)(Citation: Trend Micro HeartBeat Campaign January 2013)(Citation: Talos Bisonal 10 Years March 2020)

Techniques Used

Tonto Team has routed their traffic through an external server in order to obfuscate their location.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

Tonto Team has used tools such as

NBTscan to enumerate network shares.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|


NBTscan to enumerate network shares.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

Tonto Team has used a variety of credential dumping tools.(Citation: TrendMicro Tonto Team October 2020) |
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Tonto Team has used Python-based tools for execution.(Citation: TrendMicro Tonto Team October 2020) |
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Tonto Team has used keylogging tools in their operations.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

Tonto Team has used EternalBlue exploits for lateral movement.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1069.001|Local Groups|

Tonto Team has used the

Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Tonto Team has used PowerShell to download additional payloads.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Tonto Team has downloaded malicious DLLs which served as a

ShadowPad loader.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|


Tonto Team has delivered payloads via spearphishing attachments.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.(Citation: Kaspersky CactusPete Aug 2020)(Citation: TrendMicro Tonto Team October 2020)(Citation: Talos Bisonal Mar 2020)(Citation: Talos Bisonal 10 Years March 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Tonto Team has relied on user interaction to open their malicious RTF documents.(Citation: TrendMicro Tonto Team October 2020)(Citation: Talos Bisonal Mar 2020) |


Transparent Tribe - G0134

Created: 2021-09-02T15:14:33.738Z

Modified: 2022-09-22T20:27:21.053Z

Contributors: Manikantan Srinivasan, NEC Corporation India,Pooja Natarajan, NEC Corporation India,Hiroki Nagahama, NEC Corporation

Aliases

Transparent Tribe,COPPER FIELDSTONE,APT36,Mythic Leopard,ProjectM

Description

Transparent Tribe is a suspected Pakistan-based threat group that has been active since at least 2013, primarily targeting diplomatic, defense, and research organizations in India and Afghanistan.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Transparent Tribe May 2021)

Techniques Used

Transparent Tribe has used websites with malicious hyperlinks and iframes to infect targeted victims with

Crimson,

njRAT, and other malicious tools.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Unit 42 ProjectM March 2016)(Citation: Talos Transparent Tribe May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Transparent Tribe has embedded links to malicious downloads in e-mails.(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Transparent Tribe has directed users to open URLs hosting malicious content.(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|

Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.(Citation: Kaspersky Transparent Tribe August 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|


Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.(Citation: Kaspersky Transparent Tribe August 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1568|Dynamic Resolution|

Transparent Tribe has used dynamic DNS services to set up C2.(Citation: Proofpoint Operation Transparent Tribe March 2016)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Transparent Tribe has crafted VBS-based malicious documents.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)     |
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Talos Transparent Tribe May 2021)|
|mitre-attack|enterprise-attack|PRE|T1584.001|Domains|

Transparent Tribe has compromised domains for use in targeted malicious campaigns.(Citation: Proofpoint Operation Transparent Tribe March 2016)|
|mitre-attack|enterprise-attack|PRE|T1608.004|Drive-by Target|

Transparent Tribe has set up websites with malicious hyperlinks and iframes to infect targeted victims with

Crimson,

njRAT, and other malicious tools.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Unit 42 ProjectM March 2016)(Citation: Talos Transparent Tribe May 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)(Citation: Unit 42 ProjectM March 2016)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|


Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Talos Oblique RAT March 2021)(Citation: Talos Transparent Tribe May 2021)(Citation: Unit 42 ProjectM March 2016)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Transparent Tribe has crafted malicious files to exploit CVE-2012-0158 and CVE-2010-3333 for execution.(Citation: Proofpoint Operation Transparent Tribe March 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Transparent Tribe has dropped encoded executables on compromised hosts.(Citation: Proofpoint Operation Transparent Tribe March 2016)|


Tropic Trooper - G0081

Created: 2019-01-29T20:17:48.717Z

Modified: 2021-04-26T14:15:15.610Z

Contributors: Edward Millington,Bart Parys

Aliases

Tropic Trooper,Pirate Panda,KeyBoy

Description

Tropic Trooper is an unaffiliated threat group that has led targeted campaigns against targets in Taiwan, the Philippines, and Hong Kong. Tropic Trooper focuses on targeting government, healthcare, transportation, and high-tech industries and has been active since 2011.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)

Techniques Used

Tropic Trooper has deleted dropper files on an infected system using command scripts.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Tropic Trooper has tested if the localhost network is available and other connection capability on an infected system using command scripts.(Citation: TrendMicro Tropic Trooper May 2020) |
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Tropic Trooper has used Windows command scripts.(Citation: TrendMicro Tropic Trooper May 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Tropic Trooper has used scripts to collect the host's network topology.(Citation: TrendMicro Tropic Trooper May 2020) |
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Tropic Trooper has detected a target system’s OS version and system volume information.(Citation: TrendMicro TropicTrooper 2015)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|


Tropic Trooper has collected information automatically using the adversary's

USBferry attack.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Tropic Trooper has monitored files' modified time.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1052.001|Exfiltration over USB|

Tropic Trooper has exfiltrated data using USB storage devices.(Citation: TrendMicro Tropic Trooper May 2020)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1020|Automated Exfiltration|

Tropic Trooper has used a copy function to automatically exfiltrate sensitive data from air-gapped systems using USB storage.(Citation: TrendMicro Tropic Trooper May 2020)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

Tropic Trooper has used known administrator account credentials to execute the backdoor directly.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Tropic Trooper has hidden payloads in Flash directories and fake installer files.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Tropic Trooper's backdoor could list the infected system's installed software.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.004|DNS|


Tropic Trooper's backdoor has communicated to the C2 over the DNS protocol.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1573|Encrypted Channel|

Tropic Trooper has encrypted traffic with the C2 to prevent network detection.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Tropic Trooper has used multiple Windows APIs including HttpInitialize, HttpCreateHttpHandle, and HttpAddUrl.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Tropic Trooper has started a web service in the target host and wait for the adversary to connect, acting as a web shell.(Citation: TrendMicro Tropic Trooper May 2020)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

Tropic Trooper has used base64 encoding to hide command strings delivered from the C2.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows|T1091|Replication Through Removable Media|

Tropic Trooper has attempted to transfer

USBferry from an infected USB device by copying an Autorun function to the target machine.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Tropic Trooper has used a delivered trojan to download additional files.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

Tropic Trooper has used JPG files with encrypted payloads to mask their backdoor routines and evade detection.(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|


Tropic Trooper has created shortcuts in the Startup folder to establish persistence.(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Tropic Trooper has used HTTP in communication with the C2.(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Tropic Trooper has lured victims into executing malware via malicious e-mail attachments.(Citation: Anomali Pirate Panda April 2020)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

Tropic Trooper has installed a service pointing to a malicious DLL dropped to disk.(Citation: PWC KeyBoys Feb 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Tropic Trooper used

Tropic Trooper used

Tropic Trooper used

Tropic Trooper has been known to side-load DLLs using a valid version of a Windows Address Book and Windows Defender executable with one of their tools.(Citation: CitizenLab KeyBoy Nov 2016)(Citation: Anomali Pirate Panda April 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Tropic Trooper has executed commands through Microsoft security vulnerabilities, including CVE-2017-11882, CVE-2018-0802, and CVE-2012-0158.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: Unit 42 Tropic Trooper Nov 2016)|
|mitre-attack|enterprise-attack|Windows|T1055.001|Dynamic-link Library Injection|


Tropic Trooper has injected a DLL backdoor into dllhost.exe and svchost.exe.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Tropic Trooper has encrypted configuration files.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1573.002|Asymmetric Cryptography|

Tropic Trooper has used SSL to connect to C2 servers.(Citation: TrendMicro Tropic Trooper Mar 2018)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Tropic Trooper sent spearphishing emails that contained malicious Microsoft Office and fake installer file attachments.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro TropicTrooper 2015)(Citation: CitizenLab Tropic Trooper Aug 2018)(Citation: Anomali Pirate Panda April 2020)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|

Tropic Trooper has created a hidden directory under

Tropic Trooper delivered malicious documents with the XLSX extension, typically used by OpenXML documents, but the file itself was actually an OLE (XLS) document.(Citation: Unit 42 Tropic Trooper Nov 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload.


Tropic Trooper used shellcode with an XOR algorithm to decrypt a payload.

Tropic Trooper also decrypted image files which contained a payload.(Citation: Unit 42 Tropic Trooper Nov 2016)(Citation: TrendMicro Tropic Trooper May 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.004|Winlogon Helper DLL|

Tropic Trooper has created the Registry key

Tropic Trooper is capable of enumerating the running processes on the system using

Tropic Trooper can search for anti-virus software running on the system.(Citation: Unit 42 Tropic Trooper Nov 2016)|


Turla - G0010

Created: 2017-05-31T21:31:49.816Z

Modified: 2023-03-22T05:41:28.428Z

Contributors: Matthieu Faou, ESET,Edward Millington

Aliases

Turla,IRON HUNTER,Group 88,Belugasturgeon,Waterbug,WhiteBear,Snake,Krypton,Venomous Bear

Description

Turla is a Russian-based threat group that has infected victims in over 45 countries, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies since 2004. Heightened activity was seen in mid-2015. Turla is known for conducting watering hole and spearphishing campaigns and leveraging in-house tools and malware. Turla’s espionage platform is mainly used against Windows machines, but has also been seen used against macOS and Linux machines.(Citation: Kaspersky Turla)(Citation: ESET Gazer Aug 2017)(Citation: CrowdStrike VENOMOUS BEAR)(Citation: ESET Turla Mosquito Jan 2018)

Techniques Used

Turla has modify Registry values to store payloads.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.001|Internal Proxy|

Turla has compromised internal network systems to act as a proxy to forward traffic to C2.(Citation: Talos TinyTurla September 2021)|
|mitre-attack|enterprise-attack|Windows|T1615|Group Policy Discovery|

Turla surveys a system upon check-in to discover Group Policy details using the

Turla has obtained and customized publicly-available tools like

Mimikatz.(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|


Mimikatz.(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Turla has used various JavaScript-based backdoors.(Citation: ESET Turla Mosquito Jan 2018)    |
|mitre-attack|enterprise-attack|Windows,macOS|T1553.006|Code Signing Policy Modification|

Turla has modified variables in kernel memory to turn off Driver Signature Enforcement after exploiting vulnerabilities that obtained kernel mode privileges.(Citation: Unit42 AcidBox June 2020)(Citation: GitHub Turla Driver Loader)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|

Turla has used

Turla has exploited vulnerabilities in the VBoxDrv.sys driver to obtain kernel mode privileges.(Citation: Unit42 AcidBox June 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Turla has used IronPython scripts as part of the

IronNetInjector toolchain to drop payloads.(Citation: Unit 42 IronNetInjector February 2021 )|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.003|Mail Protocols|

Turla has used multiple backdoors which communicate with a C2 server via email attachments.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

Turla has abused local accounts that have the same password across the victim’s network.(Citation: ESET Crutch December 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.(Citation: ESET Crutch December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|


Turla has used legitimate web services including Pastebin, Dropbox, and GitHub for C2 communications.(Citation: Accenture HyperStack October 2020)(Citation: ESET Crutch December 2020)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

Turla has developed its own unique malware for use in operations.(Citation: Recorded Future Turla Infra 2020)|
|mitre-attack|enterprise-attack|PRE|T1584.004|Server|

Turla has used compromised servers as infrastructure.(Citation: Recorded Future Turla Infra 2020)(Citation: Accenture HyperStack October 2020)(Citation: Talos TinyTurla September 2021)|
|mitre-attack|enterprise-attack|PRE|T1584.006|Web Services|

Turla has frequently used compromised WordPress sites for C2 infrastructure.(Citation: Recorded Future Turla Infra 2020)|
|mitre-attack|enterprise-attack|PRE|T1584.003|Virtual Private Server|

Turla has used the VPS infrastructure of compromised Iranian threat actors.(Citation: NSA NCSC Turla OilRig)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

Turla has used malware obtained after compromising other threat actors, such as

OilRig.(Citation: NSA NCSC Turla OilRig)(Citation: Recorded Future Turla Infra 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Turla has obtained information on security software, including security logging information that may indicate whether their malware has been detected.(Citation: ESET ComRAT May 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|


Turla has infected victims using watering holes.(Citation: ESET ComRAT May 2020)(Citation: Secureworks IRON HUNTER Profile)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,SaaS,Office 365,Google Workspace,IaaS|T1213|Data from Information Repositories|

Turla has used a custom .NET tool to collect documents from an organization's internal central database.(Citation: ESET ComRAT May 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1120|Peripheral Device Discovery|

Turla has used

Turla has used

Turla has used

Turla has used

Turla has used

Turla has used

Turla RPC backdoors can be used to transfer files to/from victim machines on the local network.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Windows|T1055.001|Dynamic-link Library Injection|

Turla has used Metasploit to perform reflective DLL injection in order to escalate privileges.(Citation: ESET Turla Mosquito May 2018)(Citation: Github Rapid7 Meterpreter Elevate)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Turla has encrypted files stolen from connected USB drives into a RAR file before exfiltration.(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

Turla has used WebDAV to upload stolen USB files to a cloud drive.(Citation: Symantec Waterbug Jun 2019)

Turla has also exfiltrated stolen files to OneDrive and 4shared.(Citation: ESET ComRAT May 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|


Turla has used VBS scripts throughout its operations.(Citation: Symantec Waterbug Jun 2019) |
|mitre-attack|enterprise-attack|Windows|T1555.004|Windows Credential Manager|

Turla has gathered credentials from the Windows Credential Manager tool.(Citation: Symantec Waterbug Jun 2019)    |
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Turla RPC backdoors have used cmd.exe to execute commands.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Turla RPC backdoors can upload files from victim machines.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows|T1134.002|Create Process with Token|

Turla RPC backdoors can impersonate or steal process tokens before executing commands.(Citation: ESET Turla PowerShell May 2019)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1025|Data from Removable Media|

Turla RPC backdoors can collect files from USB thumb drives.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

Turla RPC backdoors have included local UPnP RPC proxies.(Citation: ESET Turla PowerShell May 2019)    |
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Turla has used a custom decryption routine, which pulls key and salt values from other artifacts such as a WMI filter or

PowerShell Profile, to decode encrypted PowerShell payloads.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|


Turla has used a AMSI bypass, which patches the in-memory amsi.dll, in PowerShell scripts to bypass Windows antimalware products.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Turla and its RPC backdoors have used APIs calls for various tasks related to subverting AMSI and accessing then executing commands through RPC and/or named pipes.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

Turla has used WMI event filters and consumers to establish persistence.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

Turla has used encryption (including salted 3DES via

PowerSploit's

Turla has used the Registry to store encrypted and encoded payloads.(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)|
|mitre-attack|enterprise-attack|Windows|T1546.013|PowerShell Profile|

Turla has used PowerShell profiles to maintain persistence on an infected machine.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Windows|T1547.004|Winlogon Helper DLL|

Turla established persistence by adding a Shell value under the Registry key

Turla has used PowerShell to execute commands/scripts, in some cases via a custom executable or code from

Empire's PSInject.(Citation: ESET Turla Mosquito May 2018)(Citation: ESET Turla PowerShell May 2019)(Citation: Symantec Waterbug Jun 2019)

Turla has also used PowerShell scripts to load and execute malware in memory.|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|


Turla has also used PowerShell scripts to load and execute malware in memory.|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Turla has used HTTP and HTTPS for C2 communications.(Citation: ESET Turla Mosquito Jan 2018)(Citation: ESET Turla Mosquito May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Turla has used spearphishing via a link to get users to download and run their malware.(Citation: ESET Turla Mosquito Jan 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Turla has used shellcode to download Meterpreter after compromising a victim.(Citation: ESET Turla Mosquito May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Turla attempted to trick targets into clicking on a link featuring a seemingly legitimate domain from Adobe.com to download their malware and gain initial access.(Citation: ESET Turla Mosquito Jan 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

Turla has also used

PowerSploit's

Turla Javascript backdoor added a local_update_check value under the Registry key

Turla custom executable containing Metasploit shellcode is saved to the Startup folder to gain persistence.(Citation: ESET Turla Mosquito Jan 2018)(Citation: ESET Turla Mosquito May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|A


Turla JavaScript backdoor has used Google Apps Script as its C2 server.(Citation: ESET Turla Mosquito Jan 2018)(Citation: ESET Turla Mosquito May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.005|Indicator Removal from Tools|Based on comparison of

Gazer versions,

Turla made an effort to obfuscate strings in the malware that could be used as IoCs, including the mutex name and named pipe.(Citation: ESET Gazer Aug 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Turla surveys a system upon check-in to discover operating system configuration details using the

Turla may attempt to connect to systems within a victim's network using

Turla surveys a system upon check-in to discover the system time by using the

Turla surveys a system upon check-in to discover remote systems on a local network using the

Turla has also used

Turla surveys a system upon check-in to discover active local network connections using the

Turla RPC backdoors have also enumerated the IPv4 TCP connection table via the

Turla surveys a system upon check-in to discover information in the Windows Registry with the

Turla has also retrieved PowerShell payloads hidden in Registry keys as well as checking keys associated with null session named pipes .(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020)

Turla RPC backdoors have also searched for files matching the

Turla used

Turla surveys a system upon check-in to discover running services and associated processes using the

Turla surveys a system upon check-in to discover running processes using the


Turla used

Turla surveys a system upon check-in to discover running services and associated processes using the

Turla surveys a system upon check-in to discover running processes using the

Turla RPC backdoors have also enumerated processes associated with specific open ports or named pipes.(Citation: ESET Turla PowerShell May 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Turla surveys a system upon check-in to discover network configuration details using the

NBTscan.(Citation: Kaspersky Turla)(Citation: Symantec Waterbug Jun 2019)(Citation: ESET ComRAT May 2020)

Turla RPC backdoors have also retrieved registered RPC interface information from process memory.(Citation: ESET Turla PowerShell May 2019)|


Volatile Cedar - G0123

Created: 2021-02-08T20:30:30.578Z

Modified: 2022-04-20T20:08:15.870Z

Contributors:

Aliases

Volatile Cedar,Lebanese Cedar

Description

Volatile Cedar is a Lebanese threat group that has targeted individuals, companies, and institutions worldwide. Volatile Cedar has been operating since 2012 and is motivated by political and ideological interests.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|PRE|T1595.003|Wordlist Scanning|Volatile Cedar has used DirBuster and GoBuster to brute force web directories and DNS subdomains.(Citation: ClearSky Lebanese Cedar Jan 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|Volatile Cedar can deploy additional tools.(Citation: ClearSky Lebanese Cedar Jan 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|Volatile Cedar has targeted publicly facing web servers, with both automatic and manual vulnerability discovery.(Citation: CheckPoint Volatile Cedar March 2015) (Citation: ClearSky Lebanese Cedar Jan 2021) |
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|Volatile Cedar can inject web shell code into a server.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021) |
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|Volatile Cedar has performed vulnerability scans of the target server.(Citation: CheckPoint Volatile Cedar March 2015)(Citation: ClearSky Lebanese Cedar Jan 2021)|


Whitefly - G0107

Created: 2020-05-26T16:55:09.674Z

Modified: 2021-10-12T21:43:24.133Z

Contributors:

Aliases

Whitefly

Description

Whitefly is a cyber espionage group that has been operating since at least 2017. The group has targeted organizations based mostly in Singapore across a wide variety of sectors, and is primarily interested in stealing large amounts of sensitive information. The group has been linked to an attack against Singapore’s largest public health organization, SingHealth.(Citation: Symantec Whitefly March 2019)

Techniques Used

Whitefly has obtained and used tools such as

Mimikatz.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Whitefly has used

Mimikatz to obtain credentials.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Whitefly has used search order hijacking to run the loader Vcrodat.(Citation: Symantec Whitefly March 2019)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Whitefly has named the malicious DLL the same name as DLLs belonging to legitimate software from various security vendors.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Whitefly has encrypted the payload used for C2.(Citation: Symantec Whitefly March 2019)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Whitefly has the ability to download additional tools from the C2.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|


Whitefly has used malicious .exe or .dll files disguised as documents or images.(Citation: Symantec Whitefly March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

Whitefly has used an open-source tool to exploit a known Windows privilege escalation vulnerability (CVE-2016-0051) on unpatched computers.(Citation: Symantec Whitefly March 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

Whitefly has used a simple remote shell tool that will call back to the C2 server and wait for commands.(Citation: Symantec Whitefly March 2019)|


Windigo - G0124

Created: 2021-02-10T19:57:38.042Z

Modified: 2021-04-26T22:32:57.046Z

Contributors:

Aliases

Windigo

Description

The Windigo group has been operating since at least 2011, compromising thousands of Linux and Unix servers using the Ebury SSH backdoor to create a spam botnet. Despite law enforcement intervention against the creators, Windigo operators continued updating Ebury through 2019.(Citation: ESET Windigo Mar 2014)(Citation: CERN Windigo June 2019)

Techniques Used

Windigo has used a script to detect which Linux distribution and version is currently installed on the system.(Citation: ESET ForSSHe December 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Windigo has used a script to detect installed software on targeted systems.(Citation: ESET ForSSHe December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

Windigo has used a Perl script for information gathering.(Citation: ESET ForSSHe December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Windigo has used a script to check for the presence of files created by OpenSSH backdoors.(Citation: ESET ForSSHe December 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Windigo has used a script to gather credentials in files left on disk by OpenSSH backdoors.(Citation: ESET ForSSHe December 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|


Windigo has distributed Windows malware via drive-by downloads.(Citation: ESET Windigo Mar 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

Windigo has delivered a generic Windows proxy Win32/Glubteta.M.

Windigo has also used multiple reverse proxy chains as part of their C2 infrastructure.(Citation: ESET Windigo Mar 2014)|


Windshift - G0112

Created: 2020-06-25T17:16:39.168Z

Modified: 2021-04-26T14:37:33.234Z

Contributors:

Aliases

Windshift,Bahamut

Description

Windshift is a threat group that has been active since at least 2017, targeting specific individuals for surveillance in government departments and critical infrastructure across the Middle East.(Citation: SANS Windshift August 2018)(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)

Techniques Used

Windshift has created LNK files in the Startup folder to establish persistence.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows|T1047|Windows Management Instrumentation|

Windshift has used WMI to collect information about target machines.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Windshift has used malware to identify the computer name of a compromised host.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Windshift has used malware to identify the username on a compromised host.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Windshift has used malware to enumerate active processes.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Windshift has used malware to identify installed software.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|


Windshift has used malware to identify installed software.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Windshift has used tools to deploy additional payloads to compromised hosts.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Windshift has used malware to identify installed AV and commonly used forensic and malware analysis tools.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Windshift has used Visual Basic 6 (VB6) payloads.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Windshift has used tools that communicate with C2 over HTTP.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Windshift has used string encoding with floating point calculations.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1566.003|Spearphishing via Service|

Windshift has used fake personas on social media to engage and target victims.(Citation: SANS Windshift August 2018) |
|mitre-attack|enterprise-attack,mobile-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Windshift has used compromised websites to register custom URL schemes on a remote system.(Citation: objective-see windtail1 dec 2018)|
|mitre-attack|enterprise-attack,mobile-attack|macOS,Windows|T1036.001|Invalid Code Signature|


Windshift has used revoked certificates to sign malware.(Citation: objective-see windtail1 dec 2018)(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Windshift has sent spearphishing emails with attachment to harvest credentials and deliver malware.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Windshift has sent spearphishing emails with links to harvest credentials and deliver malware.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

Windshift has used icons mimicking MS Office files to mask malicious executables.(Citation: objective-see windtail1 dec 2018)

Windshift has also attempted to hide executables by changing the file extension to ".scr" to mimic Windows screensavers.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Windshift has used links embedded in e-mails to lure victims into executing malicious code.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Windshift has used e-mail attachments to lure victims into executing malicious code.(Citation: SANS Windshift August 2018)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1533|Data from Local System|

Windshift has exfiltrated local account data and calendar information as part of Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1512|Video Capture|


Windshift has included video recording in the malicious apps deployed as part of Operation BULL.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1407|Download New Code at Runtime|

Windshift has included malware functionality capable of downloading new DEX files at runtime during Operation BULL.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1417.001|Keylogging|

Windshift has included keylogging capabilities as part of Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|iOS,Android|T1636.003|Contact List|

Windshift has included contact list exfiltration in the malicious apps deployed as part of Operation BULL.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1406|Obfuscated Files or Information|

Windshift has encrypted application strings using AES in ECB mode and Blowfish, and stored strings encoded in hex during Operation BULL. Further, in Operation BULL, encryption keys were stored within the application’s launcher icon file.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1636.004|SMS Messages|

Windshift has included SMS message exfiltration in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1521.001|Symmetric Cryptography|

Windshift has encrypted C2 communications using AES in CBC mode during Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1632.001|Code Signing Policy Modification|

Windshift has installed malicious MDM profiles on iOS devices as part of Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1420|File and Directory Discovery|


Windshift has included file enumeration in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1430|Location Tracking|

Windshift has included location tracking capabilities in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1426|System Information Discovery|

Windshift has included system information enumeration in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1429|Audio Capture|

Windshift has included phone call and audio recording capabilities in the malicious apps deployed as part of Operation BULL and Operation ROCK.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1627.001|Geofencing|

Windshift has region-locked their malicious applications during their Operation BULL campaign.(Citation: BlackBerry Bahamut)|
|mitre-attack|enterprise-attack,mobile-attack|Android,iOS|T1633.001|System Checks|

Windshift has deployed anti-analysis capabilities during their Operation BULL campaign.(Citation: BlackBerry Bahamut)|


Winnti Group - G0044

Created: 2017-05-31T21:32:08.682Z

Modified: 2023-03-20T22:02:53.982Z

Contributors: Edward Millington

Aliases

Winnti Group,Blackfly

Description

Winnti Group is a threat group with Chinese origins that has been active since at least 2010. The group has heavily targeted the gaming industry, but it has also expanded the scope of its targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015) Some reporting suggests a number of other groups, including Axiom, APT17, and Ke3chang, are closely linked to Winnti Group.(Citation: 401 TRG Winnti Umbrella May 2018)

Techniques Used

Winnti Group has downloaded an auxiliary program named ff.exe to infected machines.(Citation: Kaspersky Winnti April 2013)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.(Citation: Kaspersky Winnti April 2013)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Winnti Group has registered domains for C2 that mimicked sites of their intended targets.(Citation: Kaspersky Winnti April 2013)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Winnti Group used stolen certificates to sign its malware.(Citation: Kaspersky Winnti April 2013)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1014|Rootkit|

Winnti Group used a rootkit to modify typical server functionality.(Citation: Kaspersky Winnti April 2013)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|


Winnti Group looked for a specific process running on infected servers.(Citation: Kaspersky Winnti April 2013)|


WIRTE - G0090

Created: 2019-05-24T17:02:44.226Z

Modified: 2022-04-15T19:50:19.478Z

Contributors: Lab52 by S2 Grupo

Aliases

WIRTE

Description

WIRTE is a threat group that has been active since at least August 2018. WIRTE has targeted government, diplomatic, financial, military, legal, and technology organizations in the Middle East and Europe.(Citation: Lab52 WIRTE Apr 2019)(Citation: Kaspersky WIRTE November 2021)

Techniques Used

WIRTE has used HTTPS over ports 2083 and 2087 for C2.(Citation: Kaspersky WIRTE November 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

WIRTE has named a first stage dropper

WIRTE has attempted to lure users into opening malicious MS Word and Excel files to execute malicious payloads.(Citation: Kaspersky WIRTE November 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

WIRTE has sent emails to intended victims with malicious MS Word and Excel attachments.(Citation: Kaspersky WIRTE November 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

WIRTE has obtained and used

Empire for post-exploitation activities.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

WIRTE has used Base64 to decode malicious VBS script.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

WIRTE has used


WIRTE has used

WIRTE has downloaded PowerShell code from the C2 server to be executed.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

WIRTE has used PowerShell for script execution.(Citation: Lab52 WIRTE Apr 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

WIRTE has used VBScript  in its operations.(Citation: Lab52 WIRTE Apr 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

WIRTE has used HTTP for network communication.(Citation: Lab52 WIRTE Apr 2019) |


Wizard Spider - G0102

Created: 2020-05-12T18:15:29.396Z

Modified: 2023-03-22T05:44:27.289Z

Contributors: Edward Millington,Oleksiy Gayda

Aliases

Wizard Spider,UNC1878,TEMP.MixMaster,Grim Spider

Description

Wizard Spider is a Russia-based financially motivated threat group originally known for the creation and deployment of TrickBot since at least 2016. Wizard Spider possesses a diverse arsenal of tools and has conducted ransomware campaigns against a variety of organizations, ranging from major corporations to hospitals.(Citation: CrowdStrike Ryuk January 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: CrowdStrike Wizard Spider October 2020)

Techniques Used

Wizard Spider has obtained and used publicly-available post-exploitation frameworks and tools like Metasploit,

Empire,

Mimikatz.(Citation: FireEye KEGTAP SINGLEMALT October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1087.002|Domain Account|

Wizard Spider has identified domain admins through the use of “net group ‘Domain admins’” commands.(Citation: DFIR Ryuk's Return October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Wizard Spider has used "ipconfig" to identify the network configuration of a victim machine.(Citation: Sophos New Ryuk Attack October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1222.001|Windows File and Directory Permissions Modification|

Wizard Spider has used the icacls command to modify access control to backup servers, providing them with full control of all the system folders.(Citation: Sophos New Ryuk Attack October 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1588.003|Code Signing Certificates|


Wizard Spider obtained a code signing certificate signed by Digicert for some of its malware.(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows|T1553.002|Code Signing|

Wizard Spider has used Digicert code-signing certificates for some of its malware.(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.002|Security Account Manager|

Wizard Spider has acquired credentials from the SAM/SECURITY registry hives.(Citation: FireEye KEGTAP SINGLEMALT October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.004|Winlogon Helper DLL|

Wizard Spider has established persistence using Userinit by adding the Registry key HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon.(Citation: FireEye KEGTAP SINGLEMALT October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Wizard Spider has used WMI to identify anti-virus products installed on a victim's machine.(Citation: DFIR Ryuk's Return October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

Wizard Spider has exploited or attempted to exploit Zerologon (CVE-2020-1472) and EternalBlue (MS17-010) vulnerabilities.(Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: DFIR Ryuk's Return October 2020)(Citation: DFIR Ryuk in 5 Hours October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1557.001|LLMNR/NBT-NS Poisoning and SMB Relay|


Wizard Spider has used the Invoke-Inveigh PowerShell cmdlets, likely for name service poisoning.(Citation: FireEye KEGTAP SINGLEMALT October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1569.002|Service Execution|

Wizard Spider has used services.exe to execute scripts and executables during lateral movement within a victim network.(Citation: DFIR Ryuk's Return October 2020)(Citation: DFIR Ryuk in 5 Hours October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Wizard Spider has used SMB to drop Cobalt Strike Beacon on a domain controller for lateral movement.(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)(Citation: DFIR Ryuk's Return October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Wizard Spider has used “systeminfo” and similar commands to acquire detailed configuration information of a victim machine.(Citation: DFIR Ryuk's Return October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.003|Windows Command Shell|

Wizard Spider has used cmd.exe to execute commands on a victim's machine.(Citation: DFIR Ryuk's Return October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1048.003|Exfiltration Over Unencrypted Non-C2 Protocol|

Wizard Spider has exfiltrated victim information using FTP.(Citation: DFIR Ryuk's Return October 2020)(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1489|Service Stop|


Wizard Spider has used taskkill.exe and net.exe to stop backup, catalog, cloud, and other services prior to network encryption.(Citation: DFIR Ryuk's Return October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

Wizard Spider has accessed victim networks by using stolen credentials to access the corporate VPN infrastructure.(Citation: FireEye KEGTAP SINGLEMALT October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

Wizard Spider has used administrative accounts, including Domain Admin, to move laterally within a victim network.(Citation: FireEye KEGTAP SINGLEMALT October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Wizard Spider has used "whoami" to identify the local user and their privileges.(Citation: Sophos New Ryuk Attack October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Wizard Spider has established persistence via the Registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run and a shortcut within the startup folder.(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: FireEye KEGTAP SINGLEMALT October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Wizard Spider has shut down or uninstalled security applications on victim systems that might prevent ransomware from executing.(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: DFIR Ryuk's Return October 2020)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1135|Network Share Discovery|


Wizard Spider has used the “net view” command to locate mapped network shares.(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.006|Windows Remote Management|

Wizard Spider has used Window Remote Management to move laterally through a victim network.(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1558.003|Kerberoasting|

Wizard Spider has used Rubeus, MimiKatz Kerberos module, and the Invoke-Kerberoast cmdlet to steal AES hashes.(Citation: DFIR Ryuk's Return October 2020)(Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Wizard Spider has sent phishing emails containing a link to an actor-controlled Google Drive document or other free online file hosting services.(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Wizard Spider has lured victims into clicking a malicious link delivered through spearphishing.(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.003|NTDS|

Wizard Spider has gained access to credentials via exported copies of the ntds.dit Active Directory database.(Citation: FireEye KEGTAP SINGLEMALT October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1055.001|Dynamic-link Library Injection|


Wizard Spider has injected malicious DLLs into memory with read, write, and execute permissions.(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1047|Windows Management Instrumentation|

Wizard Spider has used WMI and LDAP queries for network discovery and to move laterally.(Citation: CrowdStrike Grim Spider May 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: FireEye KEGTAP SINGLEMALT October 2020)(Citation: Red Canary Hospital Thwarted Ryuk October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Wizard Spider has used valid credentials for privileged accounts with the goal of accessing domain controllers.(Citation: CrowdStrike Grim Spider May 2019) |
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators.

Wizard Spider has also used

AdFind and

Wizard Spider used Base64 encoding to obfuscate an

Empire service and PowerShell commands.(Citation: FireEye Ryuk and Trickbot January 2019)(Citation: DFIR Ryuk's Return October 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS|T1074|Data Staged|

Wizard Spider has collected and staged credentials and network enumeration information, using  the networkdll and psfin

TrickBot modules.(Citation: CrowdStrike Grim Spider May 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071.001|Web Protocols|


TrickBot modules.(Citation: CrowdStrike Grim Spider May 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Wizard Spider has used HTTP for network communications.(Citation: CrowdStrike Grim Spider May 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

Wizard Spider has exfiltrated domain credentials and network enumeration information over command and control (C2) channels.(Citation: CrowdStrike Grim Spider May 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.001|Remote Desktop Protocol|

Wizard Spider has used RDP for lateral movement.(Citation: CrowdStrike Grim Spider May 2019)(Citation: DHS/CISA Ransomware Targeting Healthcare October 2020)(Citation: DFIR Ryuk 2 Hour Speed Run November 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1570|Lateral Tool Transfer|

Wizard Spider has used stolen credentials to copy tools into the

Wizard Spider has installed

TrickBot as a service named ControlServiceA in order to establish persistence.(Citation: CrowdStrike Grim Spider May 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Wizard Spider has used file deletion to remove some modules and configurations from an infected host after use.(Citation: CrowdStrike Grim Spider May 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|