Cyb3rWard0g/ATTCKGroups huggingface dataset:
FIN7 created a custom video recording capability that could be used to monitor operations in the victim's environment.(Citation: FireEye FIN7 Aug 2018)(Citation: DOJ FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1543.003|Windows Service|

FIN7 created new Windows services and added them to the startup directories for persistence.(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows|T1553.002|Code Signing|

FIN7 has signed

Carbanak payloads with legally purchased code signing certificates.

FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

FIN7 used SQL scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|

FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file.(Citation: FireEye FIN7 April 2017)(Citation: eSentire FIN7 July 2021)(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071.004|DNS|
FIN7 has performed C2 using DNS via A, OPT, and TXT records.(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1113|Screen Capture|

FIN7 captured screenshots and desktop video recordings.(Citation: DOJ FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1559.002|Dynamic Data Exchange|

FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.(Citation: CyberScoop FIN7 Oct 2017)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1218.005|Mshta|

FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.(Citation: FireEye FIN7 April 2017)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|

FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload.(Citation: FireEye FIN7 April 2017)(Citation: Morphisec FIN7 June 2017)(Citation: FBI Flash FIN7 USB)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.(Citation: FireEye FIN7 April 2017)(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|
FIN7 malware has created scheduled tasks to establish persistence.(Citation: FireEye FIN7 April 2017)(Citation: Morphisec FIN7 June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.(Citation: FireEye FIN7 April 2017)(Citation: DOJ FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1546.011|Application Shimming|

FIN7 has used application shim databases for persistence.(Citation: FireEye FIN7 Shim Databases)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

FIN7 has created a scheduled task named “AdobeFlashSync” to establish persistence.(Citation: Morphisec FIN7 June 2017)|
FIN8 - G0061

Created: 2018-04-18T17:59:24.739Z

Modified: 2023-03-22T03:52:13.089Z

Contributors: Daniyal Naeem, BT Security

Aliases

FIN8

Description

FIN8 is a financially motivated threat group known to launch tailored spearphishing campaigns targeting the retail, restaurant, and hospitality industries. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Fin8 May 2016)

Techniques Used

FIN8 has injected malicious code into a new svchost.exe process.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

FIN8 has used HTTPS for command and control.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

FIN8 has used WMI event subscriptions for persistence.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1134.001|Token Impersonation/Theft|

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

FIN8 has used

FIN8 has retrieved a list of trusted domains by using

Nltest.exe /domain_trusts

FIN8 has used emails with malicious links to lure victims into installing malware.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|
FIN8 has used malicious e-mail attachments to lure victims into executing malware.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

FIN8 has exploited the CVE-2016-0167 local vulnerability.(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn cmd.exe execution.

FIN8 has also used WMIC for lateral movement as well as during and post compromise cleanup activities.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

FIN8 has used scheduled tasks to maintain RDP backdoors.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

FIN8 has used RAR to compress collected data before exfiltration.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1573.002|Asymmetric Cryptography|

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

FIN8 has used remote code execution to download subsequent payloads.(Citation: FireEye Fin8 May 2016)(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|
FIN8 has used RDP for lateral movement.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

FIN8 has deleted Registry keys during post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|

FIN8 aggregates staged data from a network into a single location.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments.

FIN8 also obfuscates malicious macros delivered as payloads.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

FIN8 has used

dsquery and other Active Directory utilities to enumerate hosts; they have also used

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1070.001|Clear Windows Event Logs|

FIN8 has cleared logs during post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1048.003|Exfiltration Over Unencrypted Non-C2 Protocol|
FIN8 has used FTP to exfiltrate collected data.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

FIN8 has used valid accounts for persistence and lateral movement.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

FIN8's malicious spearphishing payloads are executed as

PowerShell.

FIN8 has also used

PowerShell for lateral movement and credential access.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|
FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)

FIN8 has also executed commands remotely via

cmd.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)|
Fox Kitten - G0117

Created: 2020-12-21T21:49:47.307Z

Modified: 2023-03-22T03:53:37.888Z

Contributors:

Aliases

Fox Kitten,UNC757,Parisite,Pioneer Kitten

Description

Fox Kitten is threat actor with a suspected nexus to the Iranian government that has been active since at least 2017 against entities in the Middle East, North Africa, Europe, Australia, and North America. Fox Kitten has targeted multiple industrial verticals including oil and gas, technology, government, defense, healthcare, manufacturing, and engineering.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: Dragos PARISITE )(Citation: ClearSky Pay2Kitten December 2020)

Techniques Used

Fox Kitten has base64 encoded scripts to avoid detection.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

Fox Kitten has used Amazon Web Services to host C2.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|PRE|T1585.001|Social Media Accounts|

Fox Kitten has used a Twitter account to communicate with ransomware victims.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|PRE|T1585|Establish Accounts|

Fox Kitten has created KeyBase accounts to communicate with ransomware victims.(Citation: ClearSky Pay2Kitten December 2020)(Citation: Check Point Pay2Key November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|
Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)(Citation: Check Point Pay2Key November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

Fox Kitten has created a local user account with administrator privileges.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

Fox Kitten has brute forced RDP credentials.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

Fox Kitten has used a Perl reverse shell to communicate with C2.(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Fox Kitten has used 7-Zip to archive data.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Fox Kitten has downloaded additional tools including

PsExec directly to endpoints.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|IaaS,SaaS|T1530|Data from Cloud Storage|

Fox Kitten has obtained files from the victim's cloud storage instances.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|
Fox Kitten has searched local system resources to access sensitive documents.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1039|Data from Network Shared Drive|

Fox Kitten has searched network shares to access sensitive documents.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,SaaS,Office 365,Google Workspace,IaaS|T1213|Data from Information Repositories|

Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1021.005|VNC|

Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

Fox Kitten has used the PuTTY and Plink tools for lateral movement.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Fox Kitten has used valid accounts to access SMB shares.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1217|Browser Information Discovery|

Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|
Fox Kitten has used RDP to log in and move laterally in the target environment.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|

Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|

Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Fox Kitten has used Angry IP Scanner to detect remote systems.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Fox Kitten has used WizTree to obtain network files and directory listings.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1003.003|NTDS|

Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|
Fox Kitten has accessed files to gain valid credentials.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.005|Password Managers|

Fox Kitten has used scripts to access credential information from the KeePass database.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Fox Kitten has used prodump to dump credentials from LSASS.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Fox Kitten has base64 encoded payloads to avoid detection.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Fox Kitten has used PowerShell scripts to access credential data.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

Fox Kitten has used sticky keys to launch a command prompt.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|
Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Fox Kitten has used cmd.exe likely as a password changing mechanism.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Fox Kitten has installed web shells on compromised hosts to maintain access.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Fox Kitten has used valid credentials with various services during lateral movement.(Citation: CISA AA20-259A Iran-Based Actor September 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1572|Protocol Tunneling|

Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as

Ngrok and custom tool SSHMinion.(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|
Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.(Citation: ClearkSky Fox Kitten February 2020)(Citation: Dragos PARISITE )(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: CISA AA20-259A Iran-Based Actor September 2020)(Citation: ClearSky Pay2Kitten December 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

Fox Kitten has exploited known vulnerabilities in remote services including RDP.(Citation: ClearkSky Fox Kitten February 2020)(Citation: CrowdStrike PIONEER KITTEN August 2020)(Citation: ClearSky Pay2Kitten December 2020)|
GALLIUM - G0093

Created: 2019-07-18T20:47:50.050Z

Modified: 2022-08-12T21:26:22.303Z

Contributors: Daniyal Naeem, BT Security,Cybereason Nocturnus, @nocturnus

Aliases

GALLIUM,Operation Soft Cell

Description

GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam. Security researchers have identified GALLIUM as a likely Chinese state-sponsored group, based in part on tools used and TTPs commonly associated with Chinese threat actors.(Citation: Cybereason Soft Cell June 2019)(Citation: Microsoft GALLIUM December 2019)(Citation: Unit 42 PingPull Jun 2022)

Techniques Used

GALLIUM has used Taiwan-based servers that appear to be exclusive to

GALLIUM.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1570|Lateral Tool Transfer|

GALLIUM has used

PsExec to move laterally between hosts in the target network.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.(Citation: Microsoft GALLIUM December 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

GALLIUM used Web shells and