Cyb3rWard0g/ATTCKGroups huggingface dataset:
TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.006|Timestomp|

TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

TEMP.Veles has used scheduled task XML triggers.(Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1546.012|Image File Execution Options Injection|

TEMP.Veles has modified and added entries within

TEMP.Veles has used

Mimikatz and a custom tool, SecHack, to harvest credentials. (Citation: FireEye TRITON 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

TEMP.Veles has renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.(Citation: FireEye TRITON 2019)
|
|mitre-attack|enterprise-attack,ics-attack|Engineering Workstation,Human-Machine Interface,Control Server|T0886|Remote Services|

TEMP.Veles utilized remote desktop protocol (RDP) jump boxes to move into the ICS environment. (Citation: Dragos December 2017)|
|mitre-attack|enterprise-attack,ics-attack|None|T0817|Drive-by Compromise|

TEMP.Veles utilizes watering hole websites to target industrial employees. (Citation: Chris Bing May 2018)|
|mitre-attack|enterprise-attack,ics-attack|Control Server,Data Historian,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0862|Supply Chain Compromise|
TEMP.Veles targeted several ICS vendors and manufacturers. (Citation: Dragos Threat Intelligence August 2019)|
|mitre-attack|enterprise-attack,ics-attack|Control Server,Data Historian,Engineering Workstation,Field Controller/RTU/PLC/IED,Human-Machine Interface,Input/Output Server,Safety Instrumented System/Protection Relay|T0859|Valid Accounts|

TEMP.Veles used valid credentials when laterally moving through RDP jump boxes into the ICS environment. (Citation: Dragos December 2017)|
The White Company - G0089

Created: 2019-05-02T00:08:18.314Z

Modified: 2020-03-30T19:24:52.290Z

Contributors:

Aliases

The White Company

Description

The White Company is a likely state-sponsored threat actor with advanced capabilities. From 2017 through 2018, the group led an espionage campaign called Operation Shaheen targeting government and military organizations in Pakistan.(Citation: Cylance Shaheen Nov 2018)

Techniques Used

The White Company has sent phishing emails with malicious Microsoft Word attachments to victims.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

The White Company has used phishing lure documents that trick users into opening them and infecting their computers.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

The White Company has taken advantage of a known vulnerability in Microsoft Word (CVE 2012-0158) to execute code.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

The White Company has obfuscated their payloads through packing.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

The White Company has the ability to delete its malware entirely from the target system.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|
The White Company has checked for specific antivirus products on the target’s computer, including Kaspersky, Quick Heal, AVG, BitDefender, Avira, Sophos, Avast!, and ESET.(Citation: Cylance Shaheen Nov 2018)|
|mitre-attack|enterprise-attack|Windows,Network|T1124|System Time Discovery|

The White Company has checked the current date on the victim system.(Citation: Cylance Shaheen Nov 2018)|
Threat Group-1314 - G0028

Created: 2017-05-31T21:31:59.120Z

Modified: 2020-03-19T21:58:20.831Z

Contributors:

Aliases

Threat Group-1314,TG-1314

Description

Threat Group-1314 is an unattributed threat group that has used compromised credentials to log into a victim's remote access infrastructure. (Citation: Dell TG-1314)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|Threat Group-1314 actors spawned shells on remote systems on a victim network to execute commands.(Citation: Dell TG-1314)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|Threat Group-1314 actors mapped network drives using net use.(Citation: Dell TG-1314)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform, Altiris, to move laterally.(Citation: Dell TG-1314)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1072|Software Deployment Tools|Threat Group-1314 actors used a victim's endpoint management platform, Altiris, for lateral movement.(Citation: Dell TG-1314)|
Threat Group-3390 - G0027

Created: 2017-05-31T21:31:58.518Z

Modified: 2023-03-29T16:53:17.235Z

Contributors: Daniyal Naeem, BT Security,Kyaw Pyiyt Htet, @KyawPyiytHtet

Aliases

Threat Group-3390,Earth Smilodon,TG-3390,Emissary Panda,BRONZE UNION,APT27,Iron Tiger,LuckyMouse

Description

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims.(Citation: Dell TG-3390) The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Securelist LuckyMouse June 2018)(Citation: Trend Micro DRBControl February 2020)

Techniques Used

Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.(Citation: Lunghi Iron Tiger Linux)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Threat Group-3390 has registered domains for C2.(Citation: Lunghi Iron Tiger Linux)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.(Citation: Trend Micro Iron Tiger April 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.005|Password Managers|

Threat Group-3390 obtained a KeePass database from a compromised host.(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|
Threat Group-3390 has used

Threat Group-3390 has packed malware and tools, including using VMProtect.(Citation: Trend Micro DRBControl February 2020)(Citation: Trend Micro Iron Tiger April 2021)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

Threat Group-3390 has hosted malicious payloads on Dropbox.(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

Threat Group-3390 has exfiltrated stolen data to Dropbox.(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1195.002|Compromise Software Supply Chain|

Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.(Citation: Trend Micro Iron Tiger April 2021)|
|mitre-attack|enterprise-attack|Windows,SaaS,IaaS,Linux,macOS,Office 365|T1199|Trusted Relationship|

Threat Group-3390 has compromised third party service providers to gain access to victim's environments.(Citation: Profero APT27 December 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Threat Group-3390 has used e-mail to deliver malicious attachments to victims.(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Threat Group-3390 has lured victims into opening malicious files containing malware.(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Threat Group-3390 has obtained and used tools such as

Impacket,

pwdump,

Mimikatz,

gsecdump,

NBTscan, and
Threat Group-3390 has obtained and used tools such as

Impacket,

pwdump,

Mimikatz,

gsecdump,

NBTscan, and

Windows Credential Editor.(Citation: Unit42 Emissary Panda May 2019)(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|PRE|T1608.002|Upload Tool|

Threat Group-3390 has staged tools, including

gsecdump and WCE, on previously compromised websites.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|PRE|T1608.004|Drive-by Target|

Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.(Citation: Gallagher 2015)|
|mitre-attack|enterprise-attack|Windows|T1003.002|Security Account Manager|

Threat Group-3390 actors have used

gsecdump to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Threat Group-3390 actors have used a modified version of

Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|

Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with

China Chopper prior to exfiltration.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|
Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.(Citation: Trend Micro Iron Tiger April 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.(Citation: Unit42 Emissary Panda May 2019)    |
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Threat Group-3390 has used a variety of Web shells.(Citation: Unit42 Emissary Panda May 2019)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Lunghi Iron Tiger Linux)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|A

Threat Group-3390 tool can read and decrypt stored Registry values.(Citation: Nccgroup Emissary Panda May 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Threat Group-3390's malware can add a Registry key to

Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.(Citation: Nccgroup Emissary Panda May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|A

Threat Group-3390 tool can encrypt payloads using XOR.

Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.(Citation: Nccgroup Emissary Panda May 2018)(Citation: Securelist LuckyMouse June 2018)(Citation: Unit42 Emissary Panda May 2019)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|A
Threat Group-3390 tool has created new Registry keys under

Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.(Citation: Securelist LuckyMouse June 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Threat Group-3390 has extensively used strategic web compromises to target victims.(Citation: Dell TG-3390)(Citation: Securelist LuckyMouse June 2018)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Threat Group-3390 has performed DLL search order hijacking to execute their payload.(Citation: Nccgroup Emissary Panda May 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.012|Process Hollowing|A

Threat Group-3390 tool can spawn

Threat Group-3390 tool can use WMI to execute a binary.(Citation: Nccgroup Emissary Panda May 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Threat Group-3390 has used the

Threat Group-3390 malware has used HTTP for C2.(Citation: Securelist LuckyMouse June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Threat Group-3390 actors use

NBTscan to discover vulnerable systems.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|
Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Profero APT27 December 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Threat Group-3390 has used command-line interfaces for execution.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Unit42 Emissary Panda May 2019)|
|mitre-attack|enterprise-attack|Windows|T1562.002|Disable Windows Event Logging|

Threat Group-3390 has used appcmd.exe to disable logging on a victim server.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows|T1070.005|Network Share Connection Removal|

Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Threat Group-3390 has used PowerShell for execution.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

Threat Group-3390 has used

Threat Group-3390 has used

Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.(Citation: SecureWorks BRONZE UNION June 2017)(Citation: Trend Micro DRBControl February 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.006|Windows Remote Management|

Threat Group-3390 has used WinRM to enable remote execution.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|
Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services.(Citation: Dell TG-3390)

Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.002|Archive via Library|

Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1030|Data Transfer Size Limits|

Threat Group-3390 actors have split RAR files for exfiltration into parts.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Threat Group-3390 has downloaded additional malware and tools, including through the use of
Threat Group-3390 has downloaded additional malware and tools, including through the use of

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.(Citation: Dell TG-3390)(Citation: Unit42 Emissary Panda May 2019)|
|mitre-attack|enterprise-attack|Windows|T1003.004|LSA Secrets|

Threat Group-3390 actors have used

gsecdump to dump credentials. They have also dumped credentials from domain controllers.(Citation: Dell TG-3390)(Citation: SecureWorks BRONZE UNION June 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers.

Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.(Citation: Dell TG-3390)(Citation: Hacker News LuckyMouse June 2018)(Citation: Securelist LuckyMouse June 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1053.002|At|

Threat Group-3390 actors use

at to schedule tasks to run self-extracting RAR archives, which install

HTTPBrowser or

PlugX on other victims on a network.(Citation: Dell TG-3390)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Threat Group-3390 has used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as
Thrip - G0076

Created: 2018-10-17T00:14:20.652Z

Modified: 2021-10-12T20:13:42.274Z

Contributors:

Aliases

Thrip

Description

Thrip is an espionage group that has targeted satellite communications, telecoms, and defense contractor companies in the U.S. and Southeast Asia. The group uses custom malware as well as "living off the land" techniques. (Citation: Symantec Thrip June 2018)

Techniques Used

Thrip has obtained and used tools such as

Mimikatz and

PsExec.(Citation: Symantec Thrip June 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1048.003|Exfiltration Over Unencrypted Non-C2 Protocol|

Thrip has used WinSCP to exfiltrate data from a targeted organization over FTP.(Citation: Symantec Thrip June 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

Thrip used a cloud-based remote access software called LogMeIn for their attacks.(Citation: Symantec Thrip June 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Thrip leveraged PowerShell to run commands to download payloads, traverse the compromised networks, and carry out reconnaissance.(Citation: Symantec Thrip June 2018)|
Tonto Team - G0131

Created: 2021-05-05T17:18:25.987Z

Modified: 2022-01-27T17:51:41.433Z

Contributors:

Aliases

Tonto Team,Earth Akhlut,BRONZE HUNTLEY,CactusPete,Karma Panda

Description

Tonto Team is a suspected Chinese state-sponsored cyber espionage threat group that has primarily targeted South Korea, Japan, Taiwan, and the United States since at least 2009; by 2020 they expanded operations to include other Asian as well as Eastern European countries. Tonto Team has targeted government, military, energy, mining, financial, education, healthcare, and technology organizations, including through the Heartbeat Campaign (2009-2012) and Operation Bitter Biscuit (2017).(Citation: Kaspersky CactusPete Aug 2020)(Citation: ESET Exchange Mar 2021)(Citation: FireEye Chinese Espionage October 2019)(Citation: ARS Technica China Hack SK April 2017)(Citation: Trend Micro HeartBeat Campaign January 2013)(Citation: Talos Bisonal 10 Years March 2020)

Techniques Used

Tonto Team has routed their traffic through an external server in order to obfuscate their location.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

Tonto Team has exploited CVE-2019-0803 and MS16-032 to escalate privileges.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

Tonto Team has used tools such as

NBTscan to enumerate network shares.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|
NBTscan to enumerate network shares.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

Tonto Team has used a variety of credential dumping tools.(Citation: TrendMicro Tonto Team October 2020) |
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Tonto Team has used Python-based tools for execution.(Citation: TrendMicro Tonto Team October 2020) |
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Tonto Team has used keylogging tools in their operations.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

Tonto Team has used EternalBlue exploits for lateral movement.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1069.001|Local Groups|

Tonto Team has used the

Tonto Team has used a first stage web shell after compromising a vulnerable Exchange server.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Tonto Team has used PowerShell to download additional payloads.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Tonto Team has downloaded malicious DLLs which served as a

ShadowPad loader.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Tonto Team abuses a legitimate and signed Microsoft executable to launch a malicious DLL.(Citation: ESET Exchange Mar 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|
Tonto Team has delivered payloads via spearphishing attachments.(Citation: TrendMicro Tonto Team October 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Tonto Team has exploited Microsoft vulnerabilities, including CVE-2018-0798, CVE-2018-8174, CVE-2018-0802, CVE-2017-11882, CVE-2019-9489 CVE-2020-8468, and CVE-2018-0798 to enable execution of their delivered malicious payloads.(Citation: Kaspersky CactusPete Aug 2020)(Citation: TrendMicro Tonto Team October 2020)(Citation: Talos Bisonal Mar 2020)(Citation: Talos Bisonal 10 Years March 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Tonto Team has relied on user interaction to open their malicious RTF documents.(Citation: TrendMicro Tonto Team October 2020)(Citation: Talos Bisonal Mar 2020) |