Cyb3rWard0g/ATTCKGroups huggingface dataset:
APT41 - G0096

Created: 2019-09-23T13:43:36.945Z

Modified: 2023-03-23T15:45:58.846Z

Contributors: Kyaw Pyiyt Htet, @KyawPyiytHtet

Aliases

APT41,Wicked Panda

Description

APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting healthcare, telecom, technology, and video game industries in 14 countries. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)

Techniques Used

APT41 has added user accounts to the User and Admin groups.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

APT41 has obtained and used tools such as

Mimikatz,

pwdump,

PowerSploit, and

Windows Credential Editor.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

APT41 has uploaded files and data from a compromised host.(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

APT41 has created services to appear as benign system tools.(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

APT41 has used rundll32.exe to execute a loader.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|
APT41 has used search order hijacking to execute malicious payloads, such as Winnti RAT.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

APT41 has transferred implant files using Windows Admin Shares.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Linux,macOS|T1574.006|Dynamic Linker Hijacking|

APT41 has configured payloads to load via LD_PRELOAD.(Citation: Crowdstrike GTR2020 Mar 2020)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1480.001|Environmental Keying|

APT41 has encrypted payloads using the Data Protection API (DPAPI), which relies on keys tied to specific user accounts on specific machines.

APT41 has also environmentally keyed second stage malware with an RC5 key derived in part from the infected system's volume serial number.(Citation: Twitter ItsReallyNick APT41 EK)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

APT41 used HTTP to download payloads for CVE-2019-19781 and CVE-2020-10189 exploits.(Citation: FireEye APT41 March 2020) |
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

APT41 used  svchost.exe and

Net to execute a system service installed to launch a

Cobalt Strike BEACON loader.(Citation: FireEye APT41 March 2020)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|macOS,Linux|T1059.004|Unix Shell|

APT41 executed

APT41 has executed

APT41 used exploit payloads that initiate download via

ftp.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|
ftp.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

APT41 exploited CVE-2020-10189 against Zoho ManageEngine Desktop Central, and CVE-2019-19781 to compromise Citrix Application Delivery Controllers (ADC) and gateway devices.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Windows|T1197|BITS Jobs|

APT41 used

BITSAdmin to download and install payloads.(Citation: FireEye APT41 March 2020)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1104|Multi-Stage Channels|

APT41 used the storescyncsvc.dll BEACON backdoor to download a secondary backdoor.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT41 used

certutil to download additional files.(Citation: FireEye APT41 March 2020)(Citation: Crowdstrike GTR2020 Mar 2020)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

APT41 used VMProtected binaries in multiple intrusions.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

APT41 used the

APT41 has enumerated IP addresses of network resources and used the

APT41 leveraged the follow exploits in their operations: CVE-2012-0158, CVE-2015-1641, CVE-2017-0199, CVE-2017-11882, and CVE-2019-3396.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|
APT41 used legitimate executables to perform DLL side-loading of their malware.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT41 deleted files from the system.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1218.001|Compiled HTML File|

APT41 used compiled HTML (.chm) files for targeting.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1008|Fallback Channels|

APT41 used the Steam community page as a fallback mechanism for C2.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

APT41 malware TIDYELF loaded the main WINTERLOVE component by injecting it into the iexplore.exe process.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.004|DNS|

APT41 used DNS for C2 communications.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

APT41 collected MAC addresses from victim machines.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

APT41 has created user accounts.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|
APT41 has created user accounts.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

APT41 used a compromised account to create a scheduled task on a system.(Citation: FireEye APT41 Aug 2019)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

APT41 modified legitimate Windows services to install malware backdoors.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)

APT41 created the StorSyncSvc service to provide persistence for Cobalt Strike.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1070.003|Clear Command History|

APT41 attempted to remove evidence of some of its activity by deleting Bash histories.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

APT41 used

APT41 used a batch file to install persistence for the

Cobalt Strike BEACON loader.(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS|T1486|Data Encrypted for Impact|

APT41 used a ransomware called Encryptor RaaS to encrypt files on the targeted systems and provide a ransom note to the user.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102.001|Dead Drop Resolver|

APT41 used legitimate websites for C2 through dead drop resolvers (DDR), including GitHub, Pastebin, and Microsoft TechNet.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1496|Resource Hijacking|
APT41 deployed a Monero cryptocurrency mining tool in a victim’s environment.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

APT41 created a RAR archive of targeted files for exfiltration.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1070.001|Clear Windows Event Logs|

APT41 attempted to remove evidence of some of its activity by clearing Windows security and system events.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT41 created and modified startup files for persistence.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)

APT41 added a registry key in

APT41 used the WMIEXEC utility to execute

APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via

PowerSploit.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

APT41 used compromised credentials to log on to other systems.(Citation: FireEye APT41 Aug 2019)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|
APT41 used a keylogger called GEARSHIFT on a target system.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1195.002|Compromise Software Supply Chain|

APT41 gained access to production environments where they could inject malicious code into legitimate, signed files and widely distribute them to end users.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1568.002|Domain Generation Algorithms|

APT41 has used DGAs to change their C2 servers monthly.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090|Proxy|

APT41 used a tool called CLASSFON to covertly proxy network communications.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

APT41 compromised an online billing/payment service using VPN access between a third-party service provider and the targeted payment service.(Citation: FireEye APT41 Aug 2019)
|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

APT41 sent spearphishing emails with attachments such as compiled HTML (.chm) files to initially compromise their victims.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

APT41 attempted to masquerade their files as popular anti-virus software.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|
APT41 leveraged PowerShell to deploy malware families in victims’ environments.(Citation: FireEye APT41 Aug 2019)(Citation: FireEye APT41 March 2020)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

APT41 leveraged sticky keys to establish persistence.(Citation: FireEye APT41 Aug 2019) |
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

APT41 has used hashdump,

Mimikatz, and the Windows Credential Editor to dump password hashes from memory and authenticate to other user accounts.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

APT41 used RDP for lateral movement.(Citation: FireEye APT41 Aug 2019)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

APT41 used a malware variant called WIDETONE to conduct port scans on specified subnets.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,Azure AD,Network|T1110.002|Password Cracking|

APT41 performed password brute-force attacks on the local admin account.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,Windows|T1542.003|Bootkit|

APT41 deployed Master Boot Record bootkits on Windows systems to hide their malware and maintain persistence on victim systems.(Citation: FireEye APT41 Aug 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1014|Rootkit|
APT41 deployed rootkits on Linux systems.(Citation: FireEye APT41 Aug 2019)(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack|macOS,Windows|T1553.002|Code Signing|

APT41 leveraged code-signing certificates to sign malware when targeting both gaming and non-gaming organizations.(Citation: FireEye APT41 Aug 2019)(Citation: Group IB APT 41 June 2021)|
Aquatic Panda - G0143

Created: 2022-01-18T14:49:29.505Z

Modified: 2023-03-21T21:16:34.243Z

Contributors: NST Assure Research Team, NetSentries Technologies,Pooja Natarajan, NEC Corporation India,Hiroki Nagahama, NEC Corporation,Manikantan Srinivasan, NEC Corporation India

Aliases

Aquatic Panda

Description

Aquatic Panda is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, Aquatic Panda has primarily targeted entities in the telecommunications, technology, and government sectors.(Citation: CrowdStrike AQUATIC PANDA December 2021)

Techniques Used

Aquatic Panda has acquired and used

Cobalt Strike in its operations.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

Aquatic Panda has acquired and used

njRAT in its operations.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|

Aquatic Panda has used DLL search-order hijacking to load

Aquatic Panda has encoded PowerShell commands in Base64.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

Aquatic Panda has used native OS commands to understand privilege levels and system details.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1007|System Service Discovery|

Aquatic Panda has attempted to discover services for third party EDR products.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to
Aquatic Panda has attempted and failed to run Bash commands on a Windows host by passing them to

Aquatic Panda has used WinRAR to compress memory dumps prior to exfiltration.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

Aquatic Panda has deleted malicious executables from compromised machines.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

Aquatic Panda has attempted to harvest credentials through LSASS memory dumping.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Aquatic Panda has downloaded additional malware onto compromised hosts.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Aquatic Panda has downloaded additional scripts and executed Base64 encoded commands in PowerShell.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Aquatic Panda has attempted to stop endpoint detection and response (EDR) tools on compromised systems.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|PRE|T1595.002|Vulnerability Scanning|

Aquatic Panda has used publicly accessible DNS logging services to identify servers vulnerable to Log4j (CVE 2021-44228).(Citation: CrowdStrike AQUATIC PANDA December 2021)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518.001|Security Software Discovery|

Aquatic Panda has attempted to discover third party endpoint detection and response (EDR) tools on compromised systems.(Citation: CrowdStrike AQUATIC PANDA December 2021)|
Axiom - G0001

Created: 2017-05-31T21:31:45.629Z

Modified: 2023-03-20T22:03:44.661Z

Contributors:

Aliases

Axiom,Group 72

Description

Axiom is a suspected Chinese cyber espionage group that has targeted the aerospace, defense, government, manufacturing, and media sectors since at least 2008. Some reporting suggests a degree of overlap between Axiom and Winnti Group but the two groups appear to be distinct based on differences in reporting on TTPs and targeting.(Citation: Kaspersky Winnti April 2013)(Citation: Kaspersky Winnti June 2015)(Citation: Novetta Winnti April 2015)

Techniques Used

Axiom has collected data from a compromised network.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1583.002|DNS Server|

Axiom has acquired dynamic DNS services for use in the targeting of intended victims.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1583.003|Virtual Private Server|

Axiom has used VPS hosting providers in targeting of intended victims.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

Axiom has compressed and encrypted data prior to exfiltration.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows|T1563.002|RDP Hijacking|

Axiom has targeted victims with remote administration tools including RDP.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

Axiom has used previously compromised administrative accounts to escalate privileges.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1584.005|Botnet|
Axiom has used previously compromised administrative accounts to escalate privileges.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|PRE|T1584.005|Botnet|

Axiom has used large groups of compromised machines for use as proxy nodes.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1553|Subvert Trust Controls|

Axiom has used digital certificates to deliver malware.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,SaaS|T1189|Drive-by Compromise|

Axiom has used watering hole attacks to gain access.(Citation: Cisco Group 72)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,SaaS,Office 365,Google Workspace|T1566|Phishing|

Axiom has used spear phishing to initially compromise victims.(Citation: Cisco Group 72)(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Axiom has used exploits for multiple vulnerabilities including CVE-2014-0322, CVE-2012-4792, CVE-2012-1889, and CVE-2013-3893.(Citation: Cisco Group 72)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1001.002|Steganography|

Axiom has used steganography to hide its C2 communications.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

Axiom has been observed using SQL injection to gain access to systems.(Citation: Novetta-Axiom)(Citation: Cisco Group 72)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|
Axiom has been known to dump credentials.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.(Citation: Novetta-Axiom)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

Axiom has used RDP during operations.(Citation: Novetta-Axiom)|
BackdoorDiplomacy - G0135

Created: 2021-09-21T14:52:49.596Z

Modified: 2021-10-18T19:47:11.389Z

Contributors: Zaw Min Htun, @Z3TAE

Aliases

BackdoorDiplomacy

Description

BackdoorDiplomacy is a cyber espionage threat group that has been active since at least 2017. BackdoorDiplomacy has targeted Ministries of Foreign Affairs and telecommunication companies in Africa, Europe, the Middle East, and Asia.(Citation: ESET BackdoorDiplomacy Jun 2021)

Techniques Used

BackdoorDiplomacy has used an executable to detect removable media, such as USB flash drives.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

BackdoorDiplomacy has copied files of interest to the main drive's recycle bin.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS,Network|T1505.003|Web Shell|

BackdoorDiplomacy has used web shells to establish an initial foothold and for lateral movement within a victim's system.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.002|Tool|

BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

BackdoorDiplomacy has obfuscated tools and malware it uses with VMProtect.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|
BackdoorDiplomacy has used EarthWorm for network tunneling with a SOCKS5 server and port transfer functionalities.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

BackdoorDiplomacy has disguised their backdoor droppers with naming conventions designed to blend into normal operations.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|

BackdoorDiplomacy has exploited CVE-2020-5902, an F5 BIP-IP vulnerability, to drop a Linux backdoor.

BackdoorDiplomacy has also exploited mis-configured Plesk servers.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

BackdoorDiplomacy has used NetCat and PortQry  to enumerate network connections and display the status of related TCP and UDP ports.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|

BackdoorDiplomacy has dropped implants in folders named for legitimate software.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

BackdoorDiplomacy has used SMBTouch, a vulnerability scanner, to determine whether a target is vulnerable to EternalBlue malware.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows|T1574.001|DLL Search Order Hijacking|
BackdoorDiplomacy has executed DLL search order hijacking.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

BackdoorDiplomacy has downloaded additional files and tools onto a compromised host.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|PRE|T1588.001|Malware|

BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.(Citation: ESET BackdoorDiplomacy Jun 2021)|
|mitre-attack|enterprise-attack|Windows|T1055.001|Dynamic-link Library Injection|

BackdoorDiplomacy has dropped legitimate software onto a compromised host and used it to execute malicious DLLs.(Citation: ESET BackdoorDiplomacy Jun 2021)|