Cyb3rWard0g/ATTCKGroups huggingface dataset:
Kimsuky - G0094

Created: 2019-08-26T15:03:02.577Z

Modified: 2022-11-30T22:53:00.875Z

Contributors: Taewoo Lee, KISA,Dongwook Kim, KISA

Aliases

Kimsuky,STOLEN PENCIL,Thallium,Black Banshee,Velvet Chollima

Description

Kimsuky is a North Korea-based cyber espionage group that has been active since at least 2012. The group initially focused on targeting South Korean government entities, think tanks, and individuals identified as experts in various fields, and expanded its operations to include the United States, Russia, Europe, and the UN. Kimsuky has focused its intelligence collection activities on foreign policy and national security issues related to the Korean peninsula, nuclear policy, and sanctions.(Citation: EST Kimsuky April 2019)(Citation: BRI Kimsuky April 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: CISA AA20-301A Kimsuky)

Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).(Citation: Netscout Stolen Pencil Dec 2018)(Citation: EST Kimsuky SmokeScreen April 2019)(Citation: AhnLab Kimsuky Kabar Cobra Feb 2019)

North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.

Techniques Used

Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails (excluding spam) from online services via IMAP.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|
Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

Kimsuky has used Blogspot pages for C2.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|

Kimsuky has obtained specific Registry keys and values on a compromised host.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

Kimsuky has created accounts with

Kimsuky has added accounts to specific groups with

Kimsuky has run

Kimsuky has checked for the presence of antivirus software with

Kimsuky has executed malware with

Kimsuky has downloaded additional malware with scheduled tasks.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1111|Multi-Factor Authentication Interception|

Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

Kimsuky has renamed malware to legitimate names such as

Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1589.003|Employee Names|

Kimsuky has collected victim employee name information.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1593.002|Search Engines|

Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1591|Gather Victim Org Information|
Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1594|Search Victim-Owned Websites|

Kimsuky has searched for information on the target company's website.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|

Kimsuky has created email accounts for phishing operations.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1583.004|Server|

Kimsuky has purchased hosting servers with virtual currency and prepaid cards.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1587.001|Malware|

Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.(Citation: KISA Operation Muzabi)(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1584.001|Domains|

Kimsuky has compromised legitimate sites and used them to distribute malware.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1588.005|Exploits|

Kimsuky has obtained exploit code for various CVEs.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

Kimsuky has lured victims into clicking malicious links.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1585.001|Social Media Accounts|

Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|
Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Kimsuky has executed Windows commands by using

Kimsuky has used

Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

Kimsuky has disguised its C2 addresses as the websites of shopping malls, governments, universities, and others.(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Kimsuky has used

Kimsuky has used an information gathering module that will hide an AV software window from the victim.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

Kimsuky has used Blogspot to host malicious content such as beacons, file exfiltrators, and implants.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

Kimsuky has hosted content used for targeting efforts via web services such as Blogspot.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Kimsuky  has used HTTP GET and POST requests for C2.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|
Kimsuky has decoded malicious VBScripts using Base64.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

Kimsuky has used QuickZip to archive stolen files before exfiltration.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Kimsuky can gather a list of all processes running on a victim's machine.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew,

Mimikatz, and

PsExec.(Citation: Netscout Stolen Pencil Dec 2018)(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

Kimsuky has collected valid email addresses that were subsequently used in spearphishing campaigns.(Citation: Malwarebytes Kimsuky June 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

Kimsuky has packed malware with UPX.(Citation: Malwarebytes Kimsuky June 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|

Kimsuky has used tools that are capable of obtaining credentials from saved mail.(Citation: Netscout Stolen Pencil Dec 2018)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|
Kimsuky has used RDP for direct remote point-and-click access.(Citation: Netscout Stolen Pencil Dec 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.(Citation: Netscout Stolen Pencil Dec 2018)|
|mitre-attack|enterprise-attack|PRE|T1593.001|Social Media|

Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.(Citation: Malwarebytes Kimsuky June 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Kimsuky has staged collected data files under

Kimsuky has used pass the hash for authentication to remote access software used in C2.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.006|Timestomp|

Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.(Citation: Cybereason Kimsuky November 2020)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace,macOS,Linux|T1114.003|Email Forwarding Rule|

Kimsuky has set auto-forward rules on victim's e-mail accounts.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.003|Mail Protocols|
Kimsuky has used e-mail to send exfiltrated data to C2 servers.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1059.006|Python|

Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.(Citation: CISA AA20-301A Kimsuky)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,IaaS|T1040|Network Sniffing|

Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.(Citation: CISA AA20-301A Kimsuky)(Citation: Netscout Stolen Pencil Dec 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1557|Adversary-in-the-Middle|

Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Kimsuky has gathered credentials using

Mimikatz and ProcDump.(Citation: CISA AA20-301A Kimsuky)(Citation: Netscout Stolen Pencil Dec 2018)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|
Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence.(Citation: CISA AA20-301A Kimsuky)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

Kimsuky has used RDP to establish persistence.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Kimsuky has disguised services to appear as benign software or related to operating system functions.(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Kimsuky has used JScript for logging and downloading additional tools.(Citation: VirusBulletin Kimsuky October 2019)(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.002|File Transfer Protocols|

Kimsuky has used FTP to download additional malware to the target machine.(Citation: VirusBulletin Kimsuky October 2019)|
|mitre-attack|enterprise-attack|PRE|T1598.003|Spearphishing Link|

Kimsuky has used links in e-mail to steal account information.(Citation: VirusBulletin Kimsuky October 2019)(Citation: Malwarebytes Kimsuky June 2021)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|PRE|T1586.002|Email Accounts|

Kimsuky has compromised email accounts to send spearphishing e-mails.(Citation: VirusBulletin Kimsuky October 2019)(Citation: Malwarebytes Kimsuky June 2021)|
|mitre-attack|enterprise-attack|PRE|T1587|Develop Capabilities|
Kimsuky created and used a mailing toolkit to use in spearphishing attacks.(Citation: VirusBulletin Kimsuky October 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding.(Citation: ThreatConnect Kimsuky September 2020)(Citation: VirusBulletin Kimsuky October 2019)

Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.(Citation: ThreatConnect Kimsuky September 2020)(Citation: VirusBulletin Kimsuky October 2019)(Citation: CISA AA20-301A Kimsuky)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Kimsuky has used Visual Basic to download malicious payloads.(Citation: ThreatConnect Kimsuky September 2020)(Citation: VirusBulletin Kimsuky October 2019)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Talos Kimsuky Nov 2021)

Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|
Kimsuky has signed files with the name EGIS CO,. Ltd..(Citation: ThreatConnect Kimsuky September 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Kimsuky has registered domains to spoof targeted organizations and trusted third parties.(Citation: ThreatConnect Kimsuky September 2020)(Citation: Zdnet Kimsuky Group September 2020)(Citation: CISA AA20-301A Kimsuky)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1562.004|Disable or Modify System Firewall|

Kimsuky has been observed disabling the system firewall.(Citation: Securelist Kimsuky Sept 2013)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.(Citation: EST Kimsuky April 2019)(Citation: Netscout Stolen Pencil Dec 2018)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

Kimsuky has exfiltrated data over its C2 channel.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

Kimsuky has created new services for persistence.(Citation: Securelist Kimsuky Sept 2013)(Citation: CISA AA20-301A Kimsuky)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|
Kimsuky has enumerated drives, OS type, OS version, and other information using a script or the "systeminfo" command.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.(Citation: Securelist Kimsuky Sept 2013)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.003|Archive via Custom Method|

Kimsuky has used RC4 encryption before exfil.(Citation: Securelist Kimsuky Sept 2013)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Kimsuky has placed scripts in the startup folder for persistence and modified the

Kimsuky has deleted the exfiltrated data on disk after transmission.

Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Kimsuky has the ability to enumerate all files and directories on an infected system.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|
Kimsuky has executed a variety of PowerShell scripts.(Citation: EST Kimsuky April 2019)(Citation: CISA AA20-301A Kimsuky)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers.

Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.(Citation: Zdnet Kimsuky Dec 2018)(Citation: CISA AA20-301A Kimsuky)(Citation: Netscout Stolen Pencil Dec 2018)(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Kimsuky has collected Office, PDF, and HWP documents from its victims.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1176|Browser Extensions|

Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.(Citation: Zdnet Kimsuky Dec 2018)(Citation: Netscout Stolen Pencil Dec 2018)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1219|Remote Access Software|

Kimsuky has used a modified TeamViewer client as a command and control channel.(Citation: Securelist Kimsuky Sept 2013)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|
Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.(Citation: EST Kimsuky April 2019)(Citation: Securelist Kimsuky Sept 2013)(Citation: CISA AA20-301A Kimsuky)(Citation: Netscout Stolen Pencil Dec 2018)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

Kimsuky has used mshta.exe to run malicious scripts on the system.(Citation: EST Kimsuky April 2019)(Citation: CISA AA20-301A Kimsuky)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: KISA Operation Muzabi)|
|mitre-attack|enterprise-attack|Windows|T1546.001|Change Default File Association|

Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.(Citation: Securelist Kimsuky Sept 2013)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Kimsuky has used emails containing Word, Excel and/or HWP (Hangul Word Processor) documents in their spearphishing campaigns.(Citation: Zdnet Kimsuky Dec 2018)(Citation: Securelist Kimsuky Sept 2013)(Citation: ThreatConnect Kimsuky September 2020)(Citation: VirusBulletin Kimsuky October 2019)(Citation: Cybereason Kimsuky November 2020)(Citation: Malwarebytes Kimsuky June 2021)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)|
LAPSUS$ - G1004

Created: 2022-06-09T19:14:31.327Z

Modified: 2023-04-11T00:01:29.232Z

Contributors: David Hughes, BT Security,Matt Brenton, Zurich Insurance Group,Flavio Costa, Cisco

Aliases

LAPSUS$,DEV-0537

Description

LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion operations, including destructive attacks without the use of ransomware. The group has targeted organizations globally, including in the government, manufacturing, higher education, energy, healthcare, technology, telecommunications, and media sectors.(Citation: BBC LAPSUS Apr 2022)(Citation: MSTIC DEV-0537 Mar 2022)(Citation: UNIT 42 LAPSUS Mar 2022)

Techniques Used

LAPSUS$ has targeted various collaboration tools like Slack, Teams, JIRA, Confluence, and others to hunt for exposed credentials to support privilege escalation and lateral movement.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|PRE|T1586.002|Email Accounts|

LAPSUS$ has payed employees, suppliers, and business partners of target organizations for credentials.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Windows,Office 365,Linux,macOS,IaaS,SaaS,Azure AD,Google Workspace|T1621|Multi-Factor Authentication Request Generation|

LAPSUS$ has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|
LAPSUS$ acquired and used the Redline password stealer in their operations.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

LAPSUS$ has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|PRE|T1591.002|Business Relationships|

LAPSUS$ has gathered detailed knowledge of an organization's supply chain relationships.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|PRE|T1591.004|Identify Roles|

LAPSUS$ has gathered detailed knowledge of team structures within a target organization.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1485|Data Destruction|

LAPSUS$ has deleted the target's systems and resources both on-premises and in the cloud.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace,macOS,Linux|T1114.003|Email Forwarding Rule|

LAPSUS$ has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS|T1531|Account Access Removal|

LAPSUS$ has removed a targeted organization's global admin accounts to lock the organization out of all access.(Citation: MSTIC DEV-0537 Mar 2022)|
|mitre-attack|enterprise-attack|Office 365,IaaS,SaaS,Google Workspace,Azure AD|T1098.003|Additional Cloud Roles|