Cyb3rWard0g/ATTCKGroups huggingface dataset:
Silence has used PowerShell to download and execute payloads.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Silence has used JS scripts.(Citation: Cyber Forensicator Silence Jan 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Silence has sent emails with malicious DOCX, CHM, LNK and ZIP attachments. (Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Silence has used scheduled tasks to stage its operation.(Citation: Cyber Forensicator Silence Jan 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Silence has used VBS scripts.(Citation: Cyber Forensicator Silence Jan 2019)|
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

Silence has used

Winexe to install a service on the remote system.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Silence has used Windows command-line to run commands.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Silence attempts to get users to launch malicious attachments delivered via spearphishing emails.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.001|Compiled HTML File|
Silence has weaponized CHM files in their phishing campaigns.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Aug 2019)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Silence has leveraged the Windows API, including using CreateProcess() or ShellExecute(), to perform a variety of tasks.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

Silence has used environment variable string substitution for obfuscation.(Citation: Cyber Forensicator Silence Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Silence has deleted artifacts, including scheduled tasks, communicates files from the C2 and other logs.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|

Silence can capture victim screen activity.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1125|Video Capture|

Silence has been observed making videos of victims to observe bank employees day to day activities.(Citation: SecureList Silence Nov 2017)(Citation: Group IB Silence Sept 2018)|
Silent Librarian - G0122

Created: 2021-02-03T16:36:38.145Z

Modified: 2021-04-21T12:02:00.278Z

Contributors:

Aliases

Silent Librarian,TA407,COBALT DICKENS

Description

Silent Librarian is a group that has targeted research and proprietary data at universities, government agencies, and private sector companies worldwide since at least 2013. Members of  Silent Librarian are known to have been affiliated with the Iran-based Mabna Institute which has conducted cyber intrusions at the behest of the government of Iran, specifically the Islamic Revolutionary Guard Corps (IRGC).(Citation: DOJ Iran Indictments March 2018)(Citation: Phish Labs Silent Librarian)(Citation: Malwarebytes Silent Librarian October 2020)

Techniques Used

Silent Librarian has cloned victim organization login pages and staged them for later use in credential harvesting campaigns.

Silent Librarian has also made use of a variety of URL shorteners for these staged websites.(Citation: Secureworks COBALT DICKENS September 2019)(Citation: Malwarebytes Silent Librarian October 2020)(Citation: Proofpoint TA407 September 2019)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.(Citation: Proofpoint TA407 September 2019)(Citation: Secureworks COBALT DICKENS September 2019)|
|mitre-attack|enterprise-attack|PRE|T1588.004|Digital Certificates|

Silent Librarian has obtained free Let's Encrypt SSL certificates for use on their phishing pages.(Citation: Phish Labs Silent Librarian)(Citation: Secureworks COBALT DICKENS September 2019)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|
Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|Windows,Office 365,Google Workspace,macOS,Linux|T1114|Email Collection|

Silent Librarian has exfiltrated entire mailboxes from compromised accounts.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace,macOS,Linux|T1114.003|Email Forwarding Rule|

Silent Librarian has set up auto forwarding rules on compromised e-mail accounts.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

Silent Librarian has collected e-mail addresses from targeted organizations from open Internet searches.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|PRE|T1589.003|Employee Names|

Silent Librarian has collected lists of names for individuals from targeted organizations.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1110.003|Password Spraying|

Silent Librarian has used collected lists of names and e-mail accounts to use in password spraying attacks against private sector targets.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|
Silent Librarian has used compromised credentials to obtain unauthorized access to online accounts.(Citation: DOJ Iran Indictments March 2018)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.(Citation: DOJ Iran Indictments March 2018)(Citation: Phish Labs Silent Librarian)(Citation: Secureworks COBALT DICKENS August 2018)(Citation: Proofpoint TA407 September 2019)(Citation: Secureworks COBALT DICKENS September 2019)(Citation: Malwarebytes Silent Librarian October 2020)|
|mitre-attack|enterprise-attack|PRE|T1594|Search Victim-Owned Websites|

Silent Librarian has searched victim's websites to identify the interests and academic areas of targeted individuals and to scrape source code, branding, and organizational contact information for phishing pages.(Citation: DOJ Iran Indictments March 2018)(Citation: Phish Labs Silent Librarian)(Citation: Proofpoint TA407 September 2019)|
|mitre-attack|enterprise-attack|PRE|T1598.003|Spearphishing Link|

Silent Librarian has used links in e-mails to direct victims to credential harvesting websites designed to appear like the targeted organization's login page.(Citation: DOJ Iran Indictments March 2018)(Citation: Phish Labs Silent Librarian)(Citation: Secureworks COBALT DICKENS August 2018)(Citation: Proofpoint TA407 September 2019)(Citation: Secureworks COBALT DICKENS September 2019)(Citation: Malwarebytes Silent Librarian October 2020)|
SilverTerrier - G0083

Created: 2019-01-29T21:36:59.793Z

Modified: 2020-05-19T23:26:11.780Z

Contributors:

Aliases

SilverTerrier

Description

SilverTerrier is a Nigerian threat group that has been seen active since 2014. SilverTerrier mainly targets organizations in high technology, higher education, and manufacturing.(Citation: Unit42 SilverTerrier 2018)(Citation: Unit42 SilverTerrier 2016)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.002|File Transfer Protocols|SilverTerrier uses FTP for C2 communications.(Citation: Unit42 SilverTerrier 2018)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|SilverTerrier uses HTTP for C2 communications.(Citation: Unit42 SilverTerrier 2018)    |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.003|Mail Protocols|SilverTerrier uses SMTP for C2 communications.(Citation: Unit42 SilverTerrier 2018)|
Sowbug - G0054

Created: 2018-01-16T16:13:52.465Z

Modified: 2020-03-30T02:46:16.483Z

Contributors: Alan Neville, @abnev

Aliases

Sowbug

Description

Sowbug is a threat group that has conducted targeted attacks against organizations in South America and Southeast Asia, particularly government entities, since at least 2015. (Citation: Symantec Sowbug Nov 2017)

Techniques Used

Sowbug named its tools to masquerade as Windows or Adobe Reader software, such as by using the file name adobecms.exe and the directory

Sowbug has used command line during its intrusions.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

Sowbug extracted Word documents from a file server on a victim network.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

Sowbug listed remote shared drives that were accessible from a victim.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

Sowbug has used credential dumping tools.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Sowbug extracted documents and bundled them into a RAR archive.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Sowbug has used keylogging tools.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|
Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.(Citation: Symantec Sowbug Nov 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Sowbug obtained OS version and hardware configuration from a victim.(Citation: Symantec Sowbug Nov 2017)|
Stealth Falcon - G0038

Created: 2017-05-31T21:32:06.390Z

Modified: 2020-11-23T18:57:19.208Z

Contributors:

Aliases

Stealth Falcon

Description

Stealth Falcon is a threat group that has conducted targeted spyware attacks against Emirati journalists, activists, and dissidents since at least 2012. Circumstantial evidence suggests there could be a link between this group and the United Arab Emirates (UAE) government, but that has not been confirmed. (Citation: Citizen Lab Stealth Falcon May 2016)

Techniques Used

Stealth Falcon malware gathers passwords from the Windows Credential Vault.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

Stealth Falcon malware gathers passwords from multiple sources, including Internet Explorer, Firefox, and Chrome.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Stealth Falcon malware gathers a list of running processes.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Stealth Falcon malware gathers data from the local victim system.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|After data is collected by

Stealth Falcon malware, it is exfiltrated over the existing C2 channel.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

Stealth Falcon malware gathers passwords from multiple sources, including Windows Credential Vault and Outlook.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|
Stealth Falcon malware uses WMI to script data collection and command execution on the victim.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

Stealth Falcon malware encrypts C2 traffic using RC4 with a hard-coded key.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Stealth Falcon malware communicates with its C2 server via HTTPS.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Stealth Falcon malware uses PowerShell commands to perform various functions, including gathering system information via WMI and executing commands from its C2 server.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Stealth Falcon malware gathers the registered user and primary owner name via WMI.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Stealth Falcon malware gathers system information via WMI, including the system directory, build number, serial number, version, manufacturer, model, and total physical memory.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Stealth Falcon malware creates a scheduled task entitled “IE Web Cache” to execute a malicious file hourly.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Stealth Falcon malware gathers system information via Windows Management Instrumentation (WMI).(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|
Stealth Falcon malware gathers the Address Resolution Protocol (ARP) table from the victim.(Citation: Citizen Lab Stealth Falcon May 2016)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|

Stealth Falcon malware attempts to determine the installed version of .NET by querying the Registry.(Citation: Citizen Lab Stealth Falcon May 2016)|
Strider - G0041

Created: 2017-05-31T21:32:07.541Z

Modified: 2020-06-29T01:43:19.374Z

Contributors:

Aliases

Strider,ProjectSauron

Description

Strider is a threat group that has been active since at least 2011 and has targeted victims in Russia, China, Sweden, Belgium, Iran, and Rwanda.(Citation: Symantec Strider Blog)(Citation: Kaspersky ProjectSauron Blog)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1564.005|Hidden File System|Strider has used a hidden file system that is stored as a file on disk.(Citation: Kaspersky ProjectSauron Full Report)|
|mitre-attack|enterprise-attack|Windows|T1556.002|Password Filter DLL|Strider has registered its persistence module on domain controllers as a Windows LSA (Local System Authority) password filter to acquire credentials any time a domain, local user, or administrator logs in or changes a password.(Citation: Kaspersky ProjectSauron Full Report)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.001|Internal Proxy|Strider has used local servers with both local network and Internet access to act as internal proxy nodes to exfiltrate data from other parts of the network without direct Internet access.(Citation: Kaspersky ProjectSauron Blog)|
Suckfly - G0039

Created: 2017-05-31T21:32:06.777Z

Modified: 2022-04-15T16:27:38.682Z

Contributors:

Aliases

Suckfly

Description

Suckfly is a China-based threat group that has been active since at least 2014. (Citation: Symantec Suckfly March 2016)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|Suckfly the victim's internal network for hosts with ports 8080, 5900, and 40 open.(Citation: Symantec Suckfly May 2016)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|Several tools used by Suckfly have been command-line driven.(Citation: Symantec Suckfly May 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|Suckfly used a signed credential-dumping tool to obtain victim account credentials.(Citation: Symantec Suckfly May 2016)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|Suckfly has used stolen certificates to sign its malware.(Citation: Symantec Suckfly March 2016)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|Suckfly used legitimate account credentials that they dumped to navigate the internal victim network as though they were the legitimate account owner.(Citation: Symantec Suckfly May 2016)|
TA459 - G0062

Created: 2018-04-18T17:59:24.739Z

Modified: 2020-03-30T19:22:32.962Z

Contributors: Valerii Marchuk, Cybersecurity Help s.r.o.

Aliases

TA459

Description

TA459 is a threat group believed to operate out of China that has targeted countries including Russia, Belarus, Mongolia, and others. (Citation: Proofpoint TA459 April 2017)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|TA459 has exploited Microsoft Word vulnerability CVE-2017-0199 for execution.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|TA459 has a VBScript for execution.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|TA459 has targeted victims using spearphishing emails with malicious Microsoft Word attachments.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|TA459 has used PowerShell for execution of a payload.(Citation: Proofpoint TA459 April 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|TA459 has attempted to get victims to open malicious Microsoft Word attachment sent via spearphishing.(Citation: Proofpoint TA459 April 2017)|
TA505 - G0092

Created: 2019-05-28T15:54:17.213Z

Modified: 2023-03-22T05:38:20.381Z

Contributors:

Aliases

TA505,Hive0065

Description

TA505 is a cyber criminal group that has been active since at least 2014. TA505 is known for frequently changing malware, driving global trends in criminal malware distribution, and ransomware campaigns involving Clop.(Citation: Proofpoint TA505 Sep 2017)(Citation: Proofpoint TA505 June 2018)(Citation: Proofpoint TA505 Jan 2019)(Citation: NCC Group TA505)(Citation: Korean FSI TA505 2020)

Techniques Used

TA505 has used base64 encoded PowerShell commands.(Citation: Cybereason TA505 April 2019)(Citation: Deep Instinct TA505 Apr 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

TA505 has used malware to disable Windows Defender.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

TA505 has staged malware on actor-controlled domains.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

TA505 has deployed payloads that use Windows API calls on a compromised host.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

TA505 has used malware such as

Azorult and

Cobalt Strike in their operations.(Citation: NCC Group TA505)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

TA505 has used a variety of tools in their operations, including

AdFind,

BloodHound,

Mimikatz, and
TA505 has used a variety of tools in their operations, including

AdFind,

BloodHound,

Mimikatz, and

PowerSploit.(Citation: NCC Group TA505)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

TA505 has decrypted packed DLLs with an XOR key.(Citation: NCC Group TA505)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

TA505 has used malware to disable Windows Defender through modification of the Registry.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

TA505 has registered domains to impersonate services such as Dropbox to distribute malware.(Citation: Korean FSI TA505 2020)|
|mitre-attack|enterprise-attack|Windows|T1553.005|Mark-of-the-Web Bypass|

TA505 has used .iso files to deploy malicious .lnk files.(Citation: TrendMicro TA505 Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1055.001|Dynamic-link Library Injection|

TA505 has been seen injecting a DLL into winword.exe.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

TA505 has used HTTP to communicate with C2 nodes.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

TA505 has used UPX to obscure malicious code.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

TA505 has used stolen domain admin accounts to compromise additional hosts.(Citation: IBM TA505 April 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1069|Permission Groups Discovery|