Cyb3rWard0g/ATTCKGroups huggingface dataset:
Sandworm Team has used intercepter-NG to sniff passwords in network traffic.(Citation: ESET Telebots Dec 2016)    |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1087.002|Domain Account|

Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.(Citation: ESET Telebots Dec 2016)  |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

Sandworm Team has sent system information to its C2 server using HTTP.(Citation: ESET Telebots Dec 2016)   |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots July 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Sandworm Team has used backdoors that can delete files used in an attack from an infected system.(Citation: ESET Telebots Dec 2016)(Citation: ESET Telebots July 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.(Citation: ESET Telebots Dec 2016)  |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows,Network|T1090|Proxy|
Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.(Citation: ESET Telebots Dec 2016)    |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.(Citation: ESET Telebots Dec 2016) |
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects (CVE-2014-4114) and Microsoft Word via crafted TIFF images (CVE-2013-3906).(Citation: iSight Sandworm Oct 2014)(Citation: TrendMicro Sandworm October 2014)(Citation: McAfee Sandworm November 2013)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Sandworm Team has delivered malicious Microsoft Office attachments via spearphishing emails.(Citation: iSight Sandworm Oct 2014)(Citation: US-CERT Ukraine Feb 2016)(Citation: ESET Telebots Dec 2016)(Citation: US District Court Indictment GRU Unit 74455 October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Sandworm Team has used Base64 encoding within malware variants.(Citation: iSight Sandworm Oct 2014)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Control Server,Data Historian,Engineering Workstation,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0859|Valid Accounts|In the Ukraine 2015 Incident,
Sandworm Team used the credentials of valid accounts to interact with client applications and access employee workstations hosting HMI applications. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)(Citation: Dragos)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|None|T0884|Connection Proxy|

Sandworm Team establishes an internal proxy prior to the installation of backdoors within the network. (Citation: Dragos Inc. June 2017)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Human-Machine Interface|T0819|Exploit Public-Facing Application|

Sandworm Team actors exploited vulnerabilities in GE's Cimplicity HMI and Advantech/Broadwin WebAccess HMI software which had been directly exposed to the internet. (Citation: ICS-CERT December 2014) (Citation: ICS CERT September 2018)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED|T0855|Unauthorized Command Message|In the Ukraine 2015 Incident,

Sandworm Team issued unauthorized commands to substation breakers after gaining control of operator workstations and accessing a distribution management system (DMS) client application. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Safety Instrumented System/Protection Relay,Field Controller/RTU/PLC/IED,Input/Output Server|T0857|System Firmware|In the Ukraine 2015 Incident,

Sandworm Team developed and used malicious firmware to render communication devices inoperable. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Control Server,Input/Output Server|T0822|External Remote Services|In the Ukraine 2015 Incident,
Sandworm Team harvested VPN worker credentials and used them to remotely log into control system networks. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016) (Citation: Zetter, Kim March 2016) (Citation: ICS-CERT February 2016) (Citation: John Hultquist January 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED|T0816|Device Restart/Shutdown|In the 2015 attack on the Ukrainian power grid, the

Sandworm Team scheduled disconnects of uninterruptable power supply (UPS) systems so that when power was disconnected from the substations, the devices would shut down and service could not be recovered. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Engineering Workstation,Human-Machine Interface,Control Server,Data Historian|T0865|Spearphishing Attachment|In the Ukraine 2015 incident,

Sandworm Team sent spearphishing attachments to three energy distribution companies containing malware to gain access to victim systems. (Citation: UNITED STATES DISTRICT COURT WESTERN DISTRICT OF PENNSYLVANIA October 2020)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED,Input/Output Server,Device Configuration/Parameters|T0804|Block Reporting Message|In the Ukraine 2015 Incident,

Sandworm Team blocked reporting messages by using malicious firmware to render communication devices inoperable. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Field Controller/RTU/PLC/IED,Device Configuration/Parameters|T0803|Block Command Message|In the Ukraine 2015 Incident,
Sandworm Team blocked command messages by using malicious firmware to render communication devices inoperable. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Human-Machine Interface|T0823|Graphical User Interface|In the Ukraine 2015 Incident,

Sandworm Team utilized HMI GUIs in the SCADA environment to open breakers. (Citation: Electricity Information Sharing and Analysis Center; SANS Industrial Control Systems March 2016)|
|mitre-attack|enterprise-attack,ics-attack,mobile-attack|Control Server,Data Historian,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server|T0807|Command-Line Interface|

Sandworm Team uses the MS-SQL server xp_cmdshell command, and PowerShell to execute commands. (Citation: Dragos October 2018)|
Scarlet Mimic - G0029

Created: 2017-05-31T21:32:00.677Z

Modified: 2020-03-30T19:16:53.144Z

Contributors:

Aliases

Scarlet Mimic

Description

Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those of the Chinese government. While there is some overlap between IP addresses used by Scarlet Mimic and Putter Panda, it has not been concluded that the groups are the same. (Citation: Scarlet Mimic Jan 2016)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.002|Right-to-Left Override|Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.(Citation: Scarlet Mimic Jan 2016)|
SideCopy - G1008

Created: 2022-08-07T13:52:07.791Z

Modified: 2022-10-24T18:51:09.213Z

Contributors: Pooja Natarajan, NEC Corporation India,Hiroki Nagahama, NEC Corporation,Manikantan Srinivasan, NEC Corporation India

Aliases

SideCopy

Description

SideCopy is a Pakistani threat group that has primarily targeted South Asian countries, including Indian and Afghani government personnel, since at least 2019. SideCopy's name comes from its infection chain that tries to mimic that of Sidewinder, a suspected Indian threat group.(Citation: MalwareBytes SideCopy Dec 2021)

Techniques Used

SideCopy has used compromised domains to host its malicious payloads.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

SideCopy has collected browser information from a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|PRE|T1598.002|Spearphishing Attachment|

SideCopy has crafted generic lures for spam campaigns to collect emails and credentials for targeting efforts.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|PRE|T1584.001|Domains|

SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

SideCopy has identified the OS version of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,IaaS|T1614|System Location Discovery|
SideCopy has identified the country location of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

SideCopy has identified the IP address of a compromised host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

SideCopy has utilized

SideCopy has executed malware by calling the API function

SideCopy has used a legitimate DLL file name,

SideCopy has used a malicious loader DLL file to execute the

SideCopy uses a loader DLL file to collect AV product names from an infected host.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

SideCopy has sent Microsoft Office Publisher documents to victims that have embedded malicious macros that execute an hta file via calling

SideCopy has delivered trojanized executables via spearphishing emails that contacts actor-controlled servers to download malicious payloads.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

SideCopy has attempted to lure victims into clicking on malicious embedded archive files sent via spearphishing campaigns.(Citation: MalwareBytes SideCopy Dec 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

SideCopy has sent spearphishing emails with malicious hta file attachments.(Citation: MalwareBytes SideCopy Dec 2021)|
Sidewinder - G0121

Created: 2021-01-27T15:57:11.183Z

Modified: 2023-03-22T05:31:54.382Z

Contributors: Lacework Labs,Daniyal Naeem, BT Security

Aliases

Sidewinder,T-APT-04,Rattlesnake

Description

Sidewinder is a suspected Indian threat actor group that has been active since at least 2012. They have been observed targeting government, military, and business entities throughout Asia, primarily focusing on Pakistan, China, Nepal, and Afghanistan.(Citation: ATT Sidewinder January 2021)(Citation: Securelist APT Trends April 2018)(Citation: Cyble Sidewinder September 2020)

Techniques Used

Sidewinder has used base64 encoding for scripts.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Sidewinder has named malicious files

Sidewinder has lured targets to click on malicious links to gain execution in the target environment.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Sidewinder has used the Windows service

Sidewinder has used the ActiveXObject utility to create OLE objects to obtain execution through Internet Explorer.(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

Sidewinder has used
Sidewinder has used

Sidewinder has lured targets to click on malicious files to gain execution in the target environment.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Sidewinder has added paths to executables in the Registry to establish persistence.(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

Sidewinder has used tools to automatically collect system and network configuration information.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1020|Automated Exfiltration|

Sidewinder has configured tools to automatically send collected files to attacker controlled servers.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Sidewinder has used HTTP in C2 communications.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Rewterz Sidewinder COVID-19 June 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Sidewinder has used tools to enumerate software installed on an infected host.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|
Sidewinder has used malware to collect information on files and directories.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Sidewinder has collected stolen files in a temporary folder in preparation for exfiltration.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Sidewinder has used malware to collect information on network interfaces, including the MAC address.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Windows,Network|T1124|System Time Discovery|

Sidewinder has used tools to obtain the current system time.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Sidewinder has used tools to identify running processes on the victim's machine.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Sidewinder has used tools to collect the computer name, OS version, installed hotfixes, as well as information regarding the memory and processor on a compromised host.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder COVID-19 June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Sidewinder has used tools to identify the user of a compromised host.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|
Sidewinder has used base64 encoding and ECDH-P256 encryption for payloads.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Sidewinder has used DLL side-loading to drop and execute malicious payloads including the hijacking of the legitimate Windows application file rekeywiz.exe.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Sidewinder has used JavaScript to drop and execute malware loaders.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder COVID-19 June 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Sidewinder has used PowerShell to drop and execute malware loaders.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Sidewinder has used VBScript to drop and execute malware loaders.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Sidewinder has exploited vulnerabilities to gain execution including CVE-2017-11882 and CVE-2020-0674.(Citation: ATT Sidewinder January 2021)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Sidewinder has used LNK files to download remote files to the victim's network.(Citation: ATT Sidewinder January 2021)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|
Sidewinder has sent e-mails with malicious attachments often crafted for specific targets.(Citation: ATT Sidewinder January 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Sidewinder has sent e-mails with malicious links often crafted for specific targets.(Citation: ATT Sidewinder January 2021)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|PRE|T1598.002|Spearphishing Attachment|

Sidewinder has sent e-mails with malicious attachments that lead victims to credential harvesting websites.(Citation: ATT Sidewinder January 2021)(Citation: Rewterz Sidewinder APT April 2020)(Citation: Cyble Sidewinder September 2020)|
|mitre-attack|enterprise-attack|PRE|T1598.003|Spearphishing Link|

Sidewinder has sent e-mails with malicious links to credential harvesting websites.(Citation: ATT Sidewinder January 2021)|
Silence - G0091

Created: 2019-05-24T17:57:36.491Z

Modified: 2023-03-22T05:34:46.346Z

Contributors: Oleg Skulkin, Group-IB

Aliases

Silence,Whisper Spider

Description

Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan. They compromised various banking systems, including the Russian Central Bank's Automated Workstation Client, ATMs, and card processing.(Citation: Cyber Forensicator Silence Jan 2019)(Citation: SecureList Silence Nov 2017)

Techniques Used

Silence has obtained and modified versions of publicly-available tools like

Empire and

PsExec.(Citation: Group IB Silence Aug 2019) (Citation: SecureList Silence Nov 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

Silence has used port 444 when sending data about the system from the client to the server.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|

Silence has used ProxyBot, which allows the attacker to redirect traffic from the current node to the backconnect server via Sock4\Socks5.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1072|Software Deployment Tools|

Silence has used RAdmin, a remote software tool used to remotely control workstations and ATMs.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

Silence has injected a DLL library containing a Trojan into the fwmain32.exe process.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Silence has used
Silence has used

Silence has downloaded additional modules and malware to victim’s machines.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Silence has used RDP for lateral movement.(Citation: Group IB Silence Sept 2018) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Silence has used Nmap to scan the corporate network, build a network topology, and identify vulnerable hosts.(Citation: Group IB Silence Sept 2018)  |
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Silence has used the Farse6.1 utility (based on

Mimikatz) to extract credentials from lsass.exe.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

Silence can create, delete, or modify a specified Registry key or value.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Silence has named its backdoor "WINWORD.exe".(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Silence has used compromised credentials to log on to other systems and escalate privileges.(Citation: Group IB Silence Sept 2018)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

Silence has used a valid certificate to sign their primary loader Silence.Downloader (aka TrueBot).(Citation: Group IB Silence Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|