Cyb3rWard0g/ATTCKGroups huggingface dataset:
Higaisa used

Higaisa exfiltrated data over its C2 channel.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.001|Binary Padding|

Higaisa performed padding with null bytes before calculating its hash.(Citation: Zscaler Higaisa 2020)|
Inception - G0100

Created: 2020-05-08T17:01:04.058Z

Modified: 2021-10-12T23:21:06.480Z

Contributors: Oleg Skulkin, Group-IB

Aliases

Inception,Inception Framework,Cloud Atlas

Description

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.(Citation: Unit 42 Inception November 2018)(Citation: Symantec Inception Framework March 2018)(Citation: Kaspersky Cloud Atlas December 2014)

Techniques Used

Inception has obtained and used open-source tools such as

LaZagne.(Citation: Kaspersky Cloud Atlas August 2019)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

Inception has enumerated installed software on compromised systems.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

Inception has used malicious HTA files to drop and execute malware.(Citation: Kaspersky Cloud Atlas August 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.(Citation: Kaspersky Cloud Atlas August 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Inception has used PowerShell to execute malicious commands and payloads.(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas December 2014)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|
Inception has used VBScript to execute malicious commands and payloads.(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas December 2014)|
|mitre-attack|enterprise-attack|Windows|T1221|Template Injection|

Inception has used decoy documents to load malicious remote payloads via HTTP.(Citation: Unit 42 Inception November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.(Citation: Kaspersky Cloud Atlas December 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Inception used a file listing plugin to collect information about file and directories both on local and remote drives.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.(Citation: Kaspersky Cloud Atlas August 2019)(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Symantec Inception Framework March 2018)(Citation: Unit 42 Inception November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Inception has used HTTP, HTTPS, and WebDav in network communications.(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Unit 42 Inception November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|
Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Kaspersky Cloud Atlas August 2019)(Citation: Symantec Inception Framework March 2018)(Citation: Unit 42 Inception November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090.003|Multi-hop Proxy|

Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Inception has maintained persistence by modifying Registry run key value

Inception has encrypted network communications with AES.(Citation: Kaspersky Cloud Atlas December 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1069.002|Domain Groups|

Inception has used specific malware modules to gather domain membership.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Windows|T1218.010|Regsvr32|

Inception has ensured persistence at system boot by setting the value

Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Inception has used a reconnaissance module to identify active processes and other associated loaded modules.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|
Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.(Citation: Symantec Inception Framework March 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.(Citation: Kaspersky Cloud Atlas December 2014)(Citation: Symantec Inception Framework March 2018)(Citation: Unit 42 Inception November 2018)(Citation: Kaspersky Cloud Atlas August 2019)|
IndigoZebra - G0136

Created: 2021-09-24T21:41:34.797Z

Modified: 2021-10-16T02:06:06.404Z

Contributors: Pooja Natarajan, NEC Corporation India,Yoshihiro Kori, NEC Corporation,Manikantan Srinivasan, NEC Corporation India

Aliases

IndigoZebra

Description

IndigoZebra is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)(Citation: Securelist APT Trends Q2 2017)

Techniques Used

IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.(Citation: Checkpoint IndigoZebra July 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.(Citation: Checkpoint IndigoZebra July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

IndigoZebra has downloaded additional files and tools from its C2 server.(Citation: Checkpoint IndigoZebra July 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

IndigoZebra has acquired open source tools such as

NBTscan and Meterpreter for their operations.(Citation: Checkpoint IndigoZebra July 2021)(Citation: Securelist APT Trends Q2 2017) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.(Citation: HackerNews IndigoZebra July 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|
IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

IndigoZebra created Dropbox accounts for their operations.(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint IndigoZebra July 2021)|
Indrik Spider - G0119

Created: 2021-01-06T17:46:35.134Z

Modified: 2022-09-15T19:49:18.799Z

Contributors:

Aliases

Indrik Spider,Evil Corp

Description

Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the Dridex banking Trojan, and then by 2017 they began running ransomware operations using BitPaymer, WastedLocker, and Hades ransomware.(Citation: Crowdstrike Indrik November 2018)(Citation: Crowdstrike EvilCorp March 2021)(Citation: Treasury EvilCorp Dec 2019)

Techniques Used

Indrik Spider has stored collected date in a .tmp file.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Indrik Spider has attempted to get users to click on a malicious zipped file.(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows|T1070.001|Clear Windows Event Logs|

Indrik Spider has used

Cobalt Strike to empty log files.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1489|Service Stop|

Indrik Spider has used

PsExec to stop services prior to the execution of ransomware.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|
Indrik Spider has used malicious JavaScript files for several components of their attack.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Indrik Spider used

Cobalt Strike to carry out credential dumping using ProcDump.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,IaaS,Linux,macOS,Google Workspace,Network|T1136|Create Account|

Indrik Spider used

Indrik Spider used

PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring.(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

Indrik Spider has used WMIC to execute commands on remote computers.(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Indrik Spider has used batch scripts on victim's machines.(Citation: Crowdstrike Indrik November 2018) |
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Indrik Spider has used PowerShell

Empire for execution of malware.(Citation: Crowdstrike Indrik November 2018)(Citation: Symantec WastedLocker June 2020) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

Indrik Spider has collected credentials from infected systems, including domain accounts.(Citation: Crowdstrike Indrik November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|
Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.(Citation: Crowdstrike Indrik November 2018)(Citation: Symantec WastedLocker June 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.(Citation: Crowdstrike Indrik November 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS|T1486|Data Encrypted for Impact|

Indrik Spider has encrypted domain-controlled systems using

BitPaymer.(Citation: Crowdstrike Indrik November 2018)|
|mitre-attack|enterprise-attack|Windows|T1484.001|Group Policy Modification|

Indrik Spider has used Group Policy Objects to deploy batch scripts.(Citation: Crowdstrike Indrik November 2018)|
|mitre-attack|enterprise-attack|PRE|T1584.004|Server|

Indrik Spider has served fake updates via legitimate websites that have been compromised.(Citation: Crowdstrike Indrik November 2018) |
Ke3chang - G0004

Created: 2017-05-31T21:31:47.177Z

Modified: 2022-07-22T18:52:32.762Z

Contributors: Pooja Natarajan, NEC Corporation India,Manikantan Srinivasan, NEC Corporation India,Hiroki Nagahama, NEC Corporation

Aliases

Ke3chang,APT15,Mirage,Vixen Panda,GREF,Playful Dragon,RoyalAPT,NICKEL

Description

Ke3chang is a threat group attributed to actors operating out of China. Ke3chang has targeted oil, government, diplomatic, military, and NGOs in Central and South America, the Caribbean, Europe, and North America since at least 2010.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: APT15 Intezer June 2018)(Citation: Microsoft NICKEL December 2021)

Techniques Used

Ke3chang has used implants to collect the system language ID of a compromised machine.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Azure AD,Office 365,SaaS,IaaS,Google Workspace|T1078.004|Cloud Accounts|

Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Ke3chang has used tools to download files to compromised machines.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1020|Automated Exfiltration|

Ke3chang has performed  frequent and scheduled data exfiltration from compromised networks.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|
Ke3chang has performed frequent and scheduled data collection from victim networks.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.003|NTDS|

Ke3chang has used NTDSDump and other password dumping tools to gather credentials.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|

Ke3chang has used implants capable of collecting the signed-in username.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Ke3chang has dropped their malware into legitimate installed software paths including:

Ke3chang has used Base64-encoded shellcode strings.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|
Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Ke3chang has obtained and used tools such as

Mimikatz.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows|T1003.004|LSA Secrets|

Ke3chang has dumped credentials, including by using gsecdump.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows|T1003.002|Security Account Manager|

Ke3chang has dumped credentials, including by using gsecdump.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

Ke3chang performs account discovery using commands such as

Ke3chang malware RoyalDNS has used DNS for C2.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1036.002|Right-to-Left Override|

Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.(Citation: Mandiant Operation Ke3chang November 2014)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

Ke3chang backdoor RoyalDNS established persistence through adding a service called

Ke3chang has used network scanning and enumeration tools, including

Ping.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows,Office 365|T1213.002|Sharepoint|
Ping.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows,Office 365|T1213.002|Sharepoint|

Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer (IE) by using the COM interface IWebBrowser2.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

Ke3chang has used keyloggers.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Windows|T1558.001|Golden Ticket|

Ke3chang has used

Mimikatz to generate Kerberos golden tickets.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

Ke3chang has used a tool known as RemoteExec (similar to

PsExec) to remotely execute batch scripts and binaries.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Ke3chang has used batch scripts in its malware to install persistence mechanisms.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|Several

Ke3chang backdoors achieved persistence by adding a Run key.(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|
Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.002|Domain Account|

Ke3chang performs account discovery using commands such as

Ke3chang gathered information and files from local directories for exfiltration.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|The

Ke3chang group has been known to compress data before exfiltration.(Citation: Mandiant Operation Ke3chang November 2014)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Ke3chang performs service discovery using

Ke3chang has dumped credentials, including by using

Mimikatz.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Ke3chang performs operating system information discovery using

Ke3chang performs discovery of permission groups

Ke3chang has performed local network configuration discovery using

Ke3chang performs local network connection discovery using

Ke3chang performs process discovery using
Ke3chang performs operating system information discovery using

Ke3chang performs discovery of permission groups

Ke3chang has performed local network configuration discovery using

Ke3chang performs local network connection discovery using

Ke3chang performs process discovery using

Ke3chang uses command-line interaction to search files and directories.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: Microsoft NICKEL December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.(Citation: Mandiant Operation Ke3chang November 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|Malware used by

Ke3chang can run commands on the command-line interface.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: NCC Group APT15 Alive and Strong)|