Cyb3rWard0g/ATTCKGroups huggingface dataset:
Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster RATs)(Citation: Kaspersky ThreatNeedle Feb 2021)(Citation: Qualys LolZarus)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1008|Fallback Channels|

Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster RATs)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1048.003|Exfiltration Over Unencrypted Non-C2 Protocol|

Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster RATs)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

Lazarus Group has collected data and files from compromised networks.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster RATs)(Citation: Kaspersky ThreatNeedle Feb 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows|T1542.003|Bootkit|

Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record (MBR) to ensure that the malware will persist even if a victim machine shuts down.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|
Lazarus Group malware KiloAlfa contains keylogging functionality.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Tools)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.002|SMB/Windows Admin Shares|

Lazarus Group malware SierraAlfa accesses the

Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2. (Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster RATs)(Citation: McAfee Lazarus Resurfaces Feb 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster RATs)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: Lazarus APT January 2022)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|
Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: Novetta Blockbuster Loaders)(Citation: SentinelOne Lazarus macOS July 2020)(Citation: TrendMicro macOS Dacls May 2020)(Citation: Kaspersky ThreatNeedle Feb 2021)(Citation: Google TAG Lazarus Jan 2021)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)(Citation: ESET Twitter Ida Pro Nov 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1012|Query Registry|

Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another

Lazarus Group malware sample checks for the presence of the following Registry key:

Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by

Lazarus Group also gathers process times.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)(Citation: TrendMicro macOS Dacls May 2020)(Citation: Lazarus APT January 2022)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1010|Application Window Discovery|

Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster Tools)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1560.002|Archive via Library|
Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.(Citation: Novetta Blockbuster RATs)(Citation: McAfee Lazarus Resurfaces Feb 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally,

Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster Tools)(Citation: US-CERT SHARPKNOT June 2018). |
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1543.003|Windows Service|Several

Lazarus Group malware families install themselves as new services.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|Several

Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another

Lazarus Group malware sample XORs C2 traffic. Other

Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads.
Lazarus Group malware sample XORs C2 traffic. Other

Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads.

Lazarus Group has also used AES to encrypt C2 traffic.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|Several

Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by

Lazarus Group also collects disk space information and sends it to its C2 server.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: McAfee GhostSecret)(Citation: Lazarus APT January 2022)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim.

Lazarus Group also uses secure file deletion to delete files from the victim.(Citation: Novetta Blockbuster)(Citation: McAfee GhostSecret)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.006|Timestomp|Several
Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files (such as calc.exe or mspaint.exe) to its dropped files.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)(Citation: Novetta Blockbuster Loaders)(Citation: McAfee GhostSecret)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,IaaS,Linux,macOS,Google Workspace,SaaS,Network|T1098|Account Manipulation|

Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.(Citation: Novetta Blockbuster)(Citation: McAfee GhostSecret)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for

Native API function names.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Loaders)(Citation: Novetta Blockbuster RATs)(Citation: McAfee Lazarus Resurfaces Feb 2018)(Citation: TrendMicro macOS Dacls May 2020)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)|
|mitre-attack|enterprise-attack,ics-attack|Engineering Workstation,Human-Machine Interface,Control Server,Data Historian|T0865|Spearphishing Attachment|
Lazarus Group has been observed targeting organizations using spearphishing documents with embedded malicious payloads. (Citation: Novetta Threat Research Group February 2016) Highly targeted spear phishing campaigns have been conducted against a U.S. electric grid company. (Citation: Eduard Kovacs March 2018)|
LazyScripter - G0140

Created: 2021-11-24T19:26:27.305Z

Modified: 2023-03-22T04:49:29.731Z

Contributors: Manikantan Srinivasan, NEC Corporation India,Pooja Natarajan, NEC Corporation India,Hiroki Nagahama, NEC Corporation

Aliases

LazyScripter

Description

LazyScripter is threat group that has mainly targeted the airlines industry since at least 2018, primarily using open-source toolsets.(Citation: MalwareBytes LazyScripter Feb 2021)

Techniques Used

LazyScripter has established GitHub accounts to host its toolsets.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

LazyScripter has used a variety of open-source remote access Trojans for its operations.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

LazyScripter had downloaded additional tools to a compromised host.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

LazyScripter has relied upon users clicking on links to malicious files.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|
LazyScripter has lured users to open malicious email attachments.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

LazyScripter has used JavaScript in its attacks.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

LazyScripter has used several different security software icons to disguise executables.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.004|DNS|

LazyScripter has leveraged dynamic DNS providers for C2 communications.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

LazyScripter has used

Koadic stagers.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

LazyScripter has used

Koadic stagers.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

LazyScripter has used GitHub to host its payloads to operate spam campaigns.(Citation: MalwareBytes LazyScripter Feb 2021) |
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

LazyScripter has used VBScript to execute malicious code.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

LazyScripter has used PowerShell scripts to execute malicious code.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|
LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

LazyScripter has used batch files to deploy open-source and multi-stage RATs.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.(Citation: MalwareBytes LazyScripter Feb 2021)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.(Citation: MalwareBytes LazyScripter Feb 2021)|
Leafminer - G0077

Created: 2018-10-17T00:14:20.652Z

Modified: 2023-03-22T04:50:51.782Z

Contributors:

Aliases

Leafminer,Raspite

Description

Leafminer is an Iranian threat group that has targeted government organizations and business entities in the Middle East since at least early 2017. (Citation: Symantec Leafminer July 2018)

Techniques Used

Leafminer has obtained and used tools such as

LaZagne,

Mimikatz,

PsExec, and

MailSniper.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

Leafminer used several tools for retrieving login and password information, including LaZagne.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

Leafminer used several tools for retrieving login and password information, including LaZagne.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows|T1003.005|Cached Domain Credentials|

Leafminer used several tools for retrieving login and password information, including LaZagne.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows|T1003.004|LSA Secrets|

Leafminer used several tools for retrieving login and password information, including LaZagne.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|

Leafminer used several tools for retrieving login and password information, including LaZagne.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.013|Process Doppelgänging|

Leafminer has used
Leafminer has used

Process Doppelgänging to evade security software while deploying tools on compromised systems.(Citation: Symantec Leafminer July 2018) |
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

Leafminer infected victims using JavaScript code.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|

Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

Leafminer obfuscated scripts that were used on victim machines.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Leafminer has infected victims using watering holes.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1110.003|Password Spraying|

Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|
Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.(Citation: Symantec Leafminer July 2018)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

Leafminer scanned network services to search for vulnerabilities in the victim system.(Citation: Symantec Leafminer July 2018)|
Leviathan - G0065

Created: 2018-04-18T17:59:24.739Z

Modified: 2022-04-15T15:15:51.198Z

Contributors: Valerii Marchuk, Cybersecurity Help s.r.o.

Aliases

Leviathan,MUDCARP,Kryptonite Panda,Gadolinium,BRONZE MOHAWK,TEMP.Jumper,APT40,TEMP.Periscope

Description

Leviathan is a Chinese state-sponsored cyber espionage group that has been attributed to the Ministry of State Security's (MSS) Hainan State Security Department and an affiliated front company.(Citation: CISA AA21-200A APT40 July 2021) Active since at least 2009, Leviathan has targeted the following sectors: academia, aerospace/aviation, biomedical, defense industrial base, government, healthcare, manufacturing, maritime, and transportation across the US, Canada, Europe, the Middle East, and Southeast Asia.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Proofpoint Leviathan Oct 2017)(Citation: FireEye Periscope March 2018)

Techniques Used

Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.(Citation: Accenture MUDCARP March 2019)|
|mitre-attack|enterprise-attack|Windows|T1559.002|Dynamic Data Exchange|

Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents. (Citation: Accenture MUDCARP March 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

Leviathan has exfiltrated data over its C2 channel.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|
Leviathan has infected victims using watering holes.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1572|Protocol Tunneling|

Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090.003|Multi-hop Proxy|

Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

Leviathan has archived victim's data prior to exfiltration.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|

Leviathan has staged data remotely prior to exfiltration.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|PRE|T1586.001|Social Media Accounts|

Leviathan has compromised social media accounts to conduct social engineering attacks.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

Leviathan has used external remote services such as virtual private networks (VPN) to gain initial access.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|
Leviathan has obtained valid accounts to gain initial access.(Citation: CISA AA21-200A APT40 July 2021)(Citation: Accenture MUDCARP March 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Office 365,SaaS,Google Workspace|T1534|Internal Spearphishing|

Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|PRE|T1586.002|Email Accounts|

Leviathan has compromised email accounts to conduct social engineering attacks.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.003|Steganography|

Leviathan has used steganography to hide stolen data inside other files stored on Github.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

Leviathan has established domains that impersonate legitimate entities to use for targeting efforts. (Citation: CISA AA21-200A APT40 July 2021)(Citation: Accenture MUDCARP March 2019)|
|mitre-attack|enterprise-attack|PRE|T1589.001|Credentials|

Leviathan has collected compromised credentials to use for targeting efforts.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|PRE|T1585.001|Social Media Accounts|

Leviathan has created new social media accounts for targeting efforts.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|PRE|T1585.002|Email Accounts|

Leviathan has created new email accounts for targeting efforts.(Citation: CISA AA21-200A APT40 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|