Cyb3rWard0g/ATTCKGroups huggingface dataset:
Gorgon Group - G0078

Created: 2018-10-17T00:14:20.652Z

Modified: 2021-10-12T21:57:25.847Z

Contributors:

Aliases

Gorgon Group

Description

Gorgon Group is a threat group consisting of members who are suspected to be Pakistan-based or have other connections to Pakistan. The group has performed a mix of criminal and targeted attacks, including campaigns against government organizations in the United Kingdom, Spain, Russia, and the United States. (Citation: Unit 42 Gorgon Group Aug 2018)

Techniques Used

Gorgon Group has obtained and used tools such as

QuasarRAT and

Remcos.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

Gorgon Group has used

PowerShell windows by setting the WindowStyle parameter to hidden. (Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1140|Deobfuscate/Decode Files or Information|

Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

Gorgon Group malware can download additional files from C2 servers.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.002|Portable Executable Injection|

Gorgon Group malware can download a remote access tool,

ShiftyBug, and inject into another process.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.012|Process Hollowing|
ShiftyBug, and inject into another process.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1055.012|Process Hollowing|

Gorgon Group malware can use process hollowing to inject one of its trojans into another process.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

Gorgon Group has used macros in

Spearphishing Attachments as well as executed VBScripts on victim machines.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the

Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.009|Shortcut Modification|

Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|
Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Gorgon Group malware can leverage the Windows API call, CreateProcessA(), for execution.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.(Citation: Unit 42 Gorgon Group Aug 2018)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|

Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under
Group5 - G0043

Created: 2017-05-31T21:32:08.304Z

Modified: 2020-03-30T19:07:39.812Z

Contributors:

Aliases

Group5

Description

Group5 is a threat group with a suspected Iranian nexus, though this attribution is not definite. The group has targeted individuals connected to the Syrian opposition via spearphishing and watering holes, normally using Syrian and Iranian themes. Group5 has used two commonly available remote access tools (RATs), njRAT and NanoCore, as well as an Android RAT, DroidJack. (Citation: Citizen Lab Group5)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.(Citation: Citizen Lab Group5)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|Malware used by Group5 is capable of remotely deleting files from victims.(Citation: Citizen Lab Group5)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1113|Screen Capture|Malware used by Group5 is capable of watching the victim's screen.(Citation: Citizen Lab Group5)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|Malware used by Group5 is capable of capturing keystrokes.(Citation: Citizen Lab Group5)|
HAFNIUM - G0125

Created: 2021-03-03T19:40:47.280Z

Modified: 2023-04-10T21:54:46.756Z

Contributors: Daniyal Naeem, BT Security,Matt Brenton, Zurich Insurance Group,Mayuresh Dani, Qualys,Harshal Tupsamudre, Qualys,Vinayak Wadhwa, SAFE Security

Aliases

HAFNIUM,Operation Exchange Marauder

Description

HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)

Techniques Used

HAFNIUM has collected data and files from a compromised machine.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|

HAFNIUM has hidden files on a compromised host.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

HAFNIUM has searched file contents on a compromised host.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

HAFNIUM has collected IP information via IPInfo.(Citation: Rapid7 HAFNIUM Mar 2021)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|

HAFNIUM has checked for network connectivity from a compromised host using

HAFNIUM has used

HAFNIUM has used

HAFNIUM has enumerated domain controllers using
HAFNIUM has checked for network connectivity from a compromised host using

HAFNIUM has used

HAFNIUM has used

HAFNIUM has enumerated domain controllers using

HAFNIUM has granted privileges to domain accounts.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

HAFNIUM has used

HAFNIUM has used

HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.(Citation: Microsoft HAFNIUM March 2020)(Citation: Rapid7 HAFNIUM Mar 2021) |
|mitre-attack|enterprise-attack|Windows,Linux,macOS,Network|T1095|Non-Application Layer Protocol|

HAFNIUM has used TCP for C2.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1132.001|Standard Encoding|

HAFNIUM has used ASCII encoding for C2 traffic.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1078.003|Local Accounts|

HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.(Citation: FireEye Exchange Zero Days March 2021)|
|mitre-attack|enterprise-attack|PRE|T1590.005|IP Addresses|

HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1136.002|Domain Account|

HAFNIUM has created domain accounts.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|PRE|T1590|Gather Victim Network Information|
HAFNIUM has created domain accounts.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|PRE|T1590|Gather Victim Network Information|

HAFNIUM gathered the fully qualified domain names (FQDNs) for targeted Exchange servers in the victim's environment.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.003|NTDS|

HAFNIUM has stolen copies of the Active Directory database (NTDS.DIT).(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

HAFNIUM has collected e-mail addresses for users they intended to target.(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560.001|Archive via Utility|

HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

HAFNIUM has used the Exchange Power Shell module

HAFNIUM has used web shells to export mailbox data.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

HAFNIUM has used

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL,

China Chopper, and
HAFNIUM has used

HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL,

China Chopper, and

ASPXSpy.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)(Citation: FireEye Exchange Zero Days March 2021)(Citation: Tarrask scheduled task)(Citation: Rapid7 HAFNIUM Mar 2021)   |
|mitre-attack|enterprise-attack|PRE|T1583.003|Virtual Private Server|

HAFNIUM has operated from leased virtual private servers (VPS) in the United States.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|PRE|T1592.004|Client Configurations|

HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

HAFNIUM has exfiltrated data to file sharing sites, including MEGA.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

HAFNIUM has used open-source C2 frameworks, including Covenant.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

HAFNIUM has acquired web services for use in C2 and exfiltration.(Citation: Microsoft HAFNIUM March 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Network,Linux,macOS,Containers|T1190|Exploit Public-Facing Application|
HAFNIUM has exploited CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065  to compromise on-premises versions of Microsoft Exchange Server, enabling access to email accounts and installation of additional malware.(Citation: Microsoft HAFNIUM March 2020)(Citation: Volexity Exchange Marauder March 2021)(Citation: FireEye Exchange Zero Days March 2021)(Citation: Tarrask scheduled task)   |
HEXANE - G1001

Created: 2018-10-17T00:14:20.652Z

Modified: 2023-03-22T04:43:59.082Z

Contributors: Dragos Threat Intelligence,Mindaugas Gudzis, BT Security

Aliases

HEXANE,Lyceum,Siamesekitten,Spirlin

Description

HEXANE is a cyber espionage threat group that has targeted oil & gas, telecommunications, aviation, and internet service provider organizations since at least 2017. Targeted companies have been located in the Middle East and Africa, including Israel, Saudi Arabia, Kuwait, Morocco, and Tunisia. HEXANE's TTPs appear similar to APT33 and OilRig but due to differences in victims and tools it is tracked as a separate entity.(Citation: Dragos Hexane)(Citation: Kaspersky Lyceum October 2021)(Citation: ClearSky Siamesekitten August 2021)(Citation: Accenture Lyceum Targets November 2021)

Techniques Used

HEXANE has acquired, and sometimes customized, open source tools such as

Mimikatz,

Empire, VNC remote access software, and DIG.net.(Citation: Kaspersky Lyceum October 2021)(Citation: SecureWorks August 2019)(Citation: Zscaler Lyceum DnsSystem June 2022)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace|T1518|Software Discovery|

HEXANE has enumerated programs installed on an infected machine.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|

HEXANE has collected the hostname of a compromised machine.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|
HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1102.002|Bidirectional Communication|

HEXANE has used cloud services, including OneDrive, for C2.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

HEXANE has used cloud services, including OneDrive, for data exfiltration.(Citation: Microsoft POLONIUM June 2022)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.002|DNS Server|

HEXANE has set up custom DNS servers to send commands to compromised hosts via TXT records.(Citation: Zscaler Lyceum DnsSystem June 2022)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

HEXANE has used

HEXANE has used

Ping and

HEXANE has used

netstat to monitor connections to specific ports.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Linux,macOS|T1016.001|Internet Connection Discovery|

HEXANE has used tools including

BITSAdmin to test internet connectivity from compromised hosts.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1053.005|Scheduled Task|

HEXANE has used a scheduled task to establish persistence for a keylogger.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

HEXANE has used a VisualBasic script named

HEXANE has used a
HEXANE has used a VisualBasic script named

HEXANE has used a

Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

HEXANE has enumerated processes on targeted systems.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1069.001|Local Groups|

HEXANE has run

HEXANE has run

HEXANE has run

HEXANE has established email accounts for use in domain registration including for ProtonMail addresses.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

HEXANE has used Base64-encoded scripts.(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1608.001|Upload Malware|

HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1585.001|Social Media Accounts|

HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Office 365,SaaS,Google Workspace|T1534|Internal Spearphishing|

HEXANE has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1589|Gather Victim Identity Information|
HEXANE has identified specific potential victims at targeted organizations.(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1591.004|Identify Roles|

HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.(Citation: SecureWorks August 2019)(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.001|Domains|

HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.(Citation: SecureWorks August 2019)(Citation: Dragos Hexane)(Citation: ClearSky Siamesekitten August 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1589.002|Email Addresses|

HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.(Citation: SecureWorks August 2019)(Citation: ClearSky Siamesekitten August 2021)
|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.001|Remote Desktop Protocol|

HEXANE has used remote desktop sessions for lateral movement.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1010|Application Window Discovery|

HEXANE has used a PowerShell-based keylogging tool to capture the window title.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

HEXANE has used a PowerShell-based keylogger named

HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.(Citation: SecureWorks August 2019)(Citation: Kaspersky APT Trends Q1 April 2021)(Citation: Kaspersky Lyceum October 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|
HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.(Citation: SecureWorks August 2019)(Citation: Dragos Hexane)(Citation: ClearSky Siamesekitten August 2021)(Citation: Zscaler Lyceum DnsSystem June 2022)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1586.002|Email Accounts|

HEXANE has used compromised accounts to send spearphishing emails.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

HEXANE has used brute force attacks to compromise valid credentials.(Citation: SecureWorks August 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1110.003|Password Spraying|

HEXANE has used password spraying attacks to obtain valid credentials.(Citation: SecureWorks August 2019)|
Higaisa - G0126

Created: 2021-03-05T18:54:56.267Z

Modified: 2021-04-22T02:12:43.892Z

Contributors: Daniyal Naeem, BT Security

Aliases

Higaisa

Description

Higaisa is a threat group suspected to have South Korean origins. Higaisa has targeted government, public, and trade organizations in North Korea; however, they have also carried out attacks in China, Japan, Russia, Poland, and other nations. Higaisa was first disclosed in early 2019 but is assessed to have operated as early as 2009.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)(Citation: PTSecurity Higaisa 2020)

Techniques Used

Higaisa has used VBScript code on the victim's machine.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1106|Native API|

Higaisa has called various native OS APIs.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the

Higaisa used a payload that creates a hidden window.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

Higaisa’s shellcode attempted to find the process ID of the current process.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1029|Scheduled Transfer|

Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|
Higaisa collected the system volume serial number, GUID, and computer name.(Citation: PTSecurity Higaisa 2020)(Citation: Malwarebytes Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

Higaisa has exploited CVE-2018-0798 for execution.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|

Higaisa used malicious e-mail attachments to lure victims into executing LNK files.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

Higaisa dropped and added

Higaisa has sent spearphishing emails containing malicious attachments.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020) |
|mitre-attack|enterprise-attack|Windows,Network|T1124|System Time Discovery|

Higaisa used a function to gather the current time.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

Higaisa added a spoofed binary to the start-up folder for persistence.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

Higaisa used

Higaisa used JavaScript to execute additional files.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

Higaisa named a shellcode loader binary
Higaisa named a shellcode loader binary

Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Windows|T1220|XSL Script Processing|

Higaisa used an XSL file to run VBScript code.(Citation: PTSecurity Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|

Higaisa used Base64 encoded compressed payloads.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.001|Internal Proxy|

Higaisa discovered system proxy settings and used them if available.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

Higaisa used HTTP and HTTPS to send data back to its C2 server.(Citation: Malwarebytes Higaisa 2020)(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1001.003|Protocol Impersonation|

Higaisa used a FakeTLS session for C2 communications.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1573.001|Symmetric Cryptography|

Higaisa used AES-128 to encrypt C2 traffic.(Citation: Zscaler Higaisa 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

Higaisa used