Cyb3rWard0g/ATTCKGroups huggingface dataset:
APT38 - G0082

Created: 2019-01-29T21:27:24.793Z

Modified: 2022-01-18T17:13:14.610Z

Contributors:

Aliases

APT38,NICKEL GLADSTONE,BeagleBoyz,Bluenoroff,Stardust Chollima

Description

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext (2018) and Banco de Chile (2018); some of their attacks have been destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017)

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Techniques Used

APT38 has used CHM files to move concealed payloads.(Citation: Kaspersky Lazarus Under The Hood APR 2017)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1588.002|Tool|

APT38 has obtained and used open-source tools such as

Mimikatz.(Citation: ESET Lazarus KillDisk April 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.006|Timestomp|
APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

APT38 has enumerated network shares on a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1543.003|Windows Service|

APT38 has installed a new Windows service to establish persistence.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|
APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1562.003|Impair Command History Logging|

APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

APT38 has used web shells for persistence or to ensure redundant access.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

APT38 have enumerated files and directories, or searched in specific locations within a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1217|Browser Information Discovery|

APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1562.004|Disable or Modify System Firewall|

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|
APT38 has collected data from a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1569.002|Service Execution|

APT38 has created new services or modified existing ones to run executables, commands, or scripts.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1106|Native API|

APT38 has used the Windows API to execute code within a victim's system.(Citation: CISA AA20-239A BeagleBoyz August 2020) |
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

APT38 has used VBScript to execute commands and other operational tasks.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|

APT38 has used PowerShell to execute commands and other operational tasks.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1218.011|Rundll32|

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|
APT38  has attempted to lure victims into enabling malicious macros within email attachments.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS|T1053.003|Cron|

APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT38 has conducted spearphishing campaigns using malicious email attachments.(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1529|System Shutdown/Reboot|

APT38 has used a custom MBR wiper named BOOTWRECK, which will initiate a system reboot after wiping the victim's MBR.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

APT38 installed a port monitoring tool, MAPMAKER, to print the active TCP connections on the local system.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS|T1485|Data Destruction|

APT38 has used a custom secure delete function to make deleted files unrecoverable.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,IaaS|T1486|Data Encrypted for Impact|

APT38 has used Hermes ransomware to encrypt files with AES256.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1561.002|Disk Structure Wipe|
APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1565.001|Stored Data Manipulation|

APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1565.002|Transmitted Data Manipulation|

APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1565.003|Runtime Data Manipulation|

APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

APT38 has conducted watering holes schemes to gain initial access to victims.(Citation: FireEye APT38 Oct 2018)(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT38 used a backdoor, NESTEGG, that has the capability to download and upload files to and from a victim’s machine.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.003|Windows Command Shell|
APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1115|Clipboard Data|

APT38 used a Trojan called KEYLIME to collect data from the clipboard.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1112|Modify Registry|

APT38 uses a tool called CLEANTOAD that has the capability to modify Registry keys.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1070.001|Clear Windows Event Logs|

APT38 clears Window Event logs and Sysmon logs from the system.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.(Citation: FireEye APT38 Oct 2018)(Citation: CISA AA20-239A BeagleBoyz August 2020)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

APT38 leveraged Sysmon to understand the processes, services in the organization.(Citation: FireEye APT38 Oct 2018)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1027.002|Software Packing|
APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.(Citation: FireEye APT38 Oct 2018)|
APT39 - G0087

Created: 2019-02-19T16:01:38.585Z

Modified: 2022-09-02T18:03:29.024Z

Contributors:

Aliases

APT39,ITG07,Chafer,Remix Kitten

Description

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer Dec 2015)(Citation: FBI FLASH APT39 September 2020)(Citation: Dept. of Treasury Iran Sanctions September 2020)(Citation: DOJ Iran Indictments September 2020)

Techniques Used

APT39 has modified and used customized versions of publicly-available tools like PLINK and

Mimikatz.(Citation: BitDefender Chafer May 2020)(Citation: IBM ITG07 June 2019)|
|mitre-attack|enterprise-attack|Windows|T1546.010|AppInit DLLs|

APT39 has used malware to set

APT39 has used malware to decrypt encrypted CAB files.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,macOS|T1553.006|Code Signing Policy Modification|

APT39 has used malware to turn off the

APT39 has used malware to delete files after they are deployed on a compromised host.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT39 has used malware to drop encrypted CAB files.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|
APT39 has exfiltrated stolen victim data through C2 communications.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

APT39 has utilized tools to aggregate data prior to exfiltration.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows|T1197|BITS Jobs|

APT39 has used the BITS protocol to exfiltrate stolen data from a compromised host.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

APT39 has used tools with the ability to search for files on a compromised host.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|

APT39 has used various strains of malware to query the Registry.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1056|Input Capture|

APT39 has utilized tools to capture mouse movements.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

APT39 has utilized malicious VBS scripts in malware.(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

APT39 has used malware disguised as Mozilla Firefox and a tool named mfevtpse.exe to proxy C2 communications, closely mimicking a legitimate McAfee file mfevtps.exe.(Citation: BitDefender Chafer May 2020)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|
APT39 has used SQL injection for initial compromise.(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|

APT39 has used a screen capture utility to take screenshots on a compromised host.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

APT39 has used tools for capturing keystrokes.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

APT39 has used various tools to steal files from the compromised host.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1115|Clipboard Data|

APT39 has used tools capable of stealing contents of the clipboard.(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT39 has downloaded tools to compromised hosts.(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

APT39 has used SMB for lateral movement.(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

APT39 has used different versions of Mimikatz to obtain credentials.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|
APT39 has used HTTP in communications with C2.(Citation: BitDefender Chafer May 2020)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

APT39 has used a command line utility and a network scanner written in python.(Citation: BitDefender Chafer May 2020)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.004|DNS|

APT39 has used remote access tools that leverage DNS in communications with C2.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

APT39 has communicated with C2 through files uploaded to and downloaded from DropBox.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

APT39 has used PowerShell to execute malicious code.(Citation: BitDefender Chafer May 2020)(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

APT39 has used the post exploitation tool

CrackMapExec to enumerate network shares.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

APT39 has used post-exploitation tools including RemCom and the Non-sucking Service Manager (NSSM) to execute processes.(Citation: BitDefender Chafer May 2020)(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

APT39 has created accounts on multiple compromised hosts to perform actions within the network.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|
APT39 has used various tools to proxy C2 communications.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

APT39 has used the Smartftp Password Decryptor tool to decrypt FTP passwords.(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

APT39 has used Ncrack to reveal credentials.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.(Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

APT39 used

Remexi to collect usernames from the system.(Citation: Symantec Chafer Dec 2015)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

APT39 has packed tools with UPX, and has repacked a modified version of

Mimikatz to thwart anti-virus detection.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|
APT39 has installed ANTAK and ASPXSPY web shells.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS|T1021.004|SSH|

APT39 used secure shell (SSH) to move laterally among their targets.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

APT39 has used stolen credentials to compromise Outlook Web Access (OWA).(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

APT39 has utilized AutoIt and custom scripts to perform internal reconnaissance.(Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

APT39 has used

CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.001|Internal Proxy|

APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|
APT39 has used WinRAR and 7-Zip to compress an archive stolen data.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

APT39 has used

NBTscan and custom tools to discover remote systems.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)(Citation: Symantec Chafer February 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.009|Shortcut Modification|

APT39 has modified LNK shortcuts.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

APT39 has created scheduled tasks for persistence.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.(Citation: FireEye APT39 Jan 2019)(Citation: BitDefender Chafer May 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT39 has maintained persistence using the startup folder.(Citation: FireEye APT39 Jan 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

APT39 leveraged spearphishing emails with malicious links to initially compromise victims.(Citation: FireEye APT39 Jan 2019)(Citation: FBI FLASH APT39 September 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|
APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.(Citation: FireEye APT39 Jan 2019)(Citation: Symantec Chafer February 2018)(Citation: FBI FLASH APT39 September 2020)|