Cyb3rWard0g/ATTCKGroups huggingface dataset:
APT29 used Kerberos ticket attacks for lateral movement.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

APT29 used WMI to steal credentials and execute backdoors at a future time.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1548.002|Bypass User Account Control|

APT29 has bypassed UAC.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

APT29 has used WMI event subscriptions for persistence.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT29 added Registry Run keys to establish persistence.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|

APT29 has used named and hijacked scheduled tasks to establish persistence.(Citation: Mandiant No Easy Breach)|
|mitre-attack|enterprise-attack|Windows|T1546.008|Accessibility Features|

APT29 used sticky-keys to obtain unauthenticated, privileged console access.(Citation: Mandiant No Easy Breach)(Citation: FireEye APT29 Domain Fronting)|
|mitre-attack|enterprise-attack|Windows|T1059.001|PowerShell|

APT29 has used encoded PowerShell scripts uploaded to

CozyCar installations to download and install

SeaDuke.(Citation: Symantec Seaduke 2015)(Citation: Mandiant No Easy Breach)(Citation: ESET T3 Threat Report 2021)(Citation: Secureworks IRON HEMLOCK Profile)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT29 has used

SDelete to remove artifacts from victim networks.(Citation: Mandiant No Easy Breach)|
APT3 - G0022

Created: 2017-05-31T21:31:55.853Z

Modified: 2021-10-01T19:09:20.817Z

Contributors: Patrick Sungbahadoor

Aliases

APT3,Gothic Panda,Pirpi,UPS Team,Buckeye,Threat Group-0110,TG-0110

Description

APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security.(Citation: FireEye Clandestine Wolf)(Citation: Recorded Future APT3 May 2017) This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.(Citation: FireEye Clandestine Wolf)(Citation: FireEye Operation Double Tap) As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.(Citation: Symantec Buckeye)

In 2017, MITRE developed an APT3 Adversary Emulation Plan.(Citation: APT3 Adversary Emulation Plan)

Techniques Used

APT3 has sent spearphishing emails containing malicious links.(Citation: FireEye Clandestine Wolf)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

APT3 has lured victims into clicking malicious links delivered through spearphishing.(Citation: FireEye Clandestine Wolf)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

APT3 has exploited the Adobe Flash Player vulnerability CVE-2015-3113 and Internet Explorer vulnerability CVE-2014-1776.(Citation: FireEye Clandestine Wolf)(Citation: FireEye Clandestine Fox)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

APT3 has used tools to dump passwords from browsers.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

APT3 has been known to use
APT3 has been known to use

PowerShell windows.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|An

APT3 downloader establishes SOCKS5 connections for its initial C2.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,IaaS,Linux,macOS,Google Workspace,SaaS,Network|T1098|Account Manipulation|

APT3 has been known to add created accounts to local admin groups to maintain elevated access.(Citation: aptsim)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,Azure AD,Network|T1110.002|Password Cracking|

APT3 has been known to brute force password hashes to be able to leverage plain text credentials.(Citation: APT3 Adversary Emulation Plan)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.005|Indicator Removal from Tools|

APT3 has been known to remove indicators of compromise from tools.(Citation: APT3 Adversary Emulation Plan)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1027.002|Software Packing|

APT3 has been known to pack their tools.(Citation: APT3 Adversary Emulation Plan)(Citation: FireEye Clandestine Wolf) |
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

APT3 has a tool that can run DLLs.(Citation: FireEye Clandestine Fox)|
|mitre-attack|enterprise-attack|Windows|T1574.002|DLL Side-Loading|

APT3 has been known to side load DLLs with a valid version of Chrome with one of their tools.(Citation: FireEye Clandestine Fox)(Citation: FireEye Clandestine Fox Part 2)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1082|System Information Discovery|
APT3 has a tool that can obtain information about the local system.(Citation: Symantec Buckeye)(Citation: evolution of pirpi)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers|T1552.001|Credentials In Files|

APT3 has a tool that can locate credentials in files on the file system such as those from Firefox or Chrome.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

APT3 will identify Microsoft Office documents on the victim's computer.(Citation: aptsim)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT3 has a tool that can delete files.(Citation: FireEye Clandestine Fox)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1041|Exfiltration Over C2 Channel|

APT3 has a tool that exfiltrates data over the C2 channel.(Citation: FireEye Clandestine Fox)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|

APT3 has a tool that creates a new service for persistence.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1057|Process Discovery|

APT3 has a tool that can list out currently running processes.(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

APT3 places scripts in the startup folder for persistence.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1136.001|Local Account|

APT3 has been known to create or enable accounts, such as

APT3 replaces the Sticky Keys binary
APT3 has been known to create or enable accounts, such as

APT3 replaces the Sticky Keys binary

APT3 has used tools to compress data before exfilling it.(Citation: aptsim)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1105|Ingress Tool Transfer|

APT3 has a tool that can copy files to remote machines.(Citation: FireEye Clandestine Fox)|
|mitre-attack|enterprise-attack|Windows|T1021.002|SMB/Windows Admin Shares|

APT3 will copy files over to Windows Admin Shares (like ADMIN$) as part of lateral movement.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

APT3 has a tool that looks for files and directories on the local file system.(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

APT3 has a tool that can detect the existence of remote systems.(Citation: Symantec Buckeye)(Citation: FireEye Clandestine Fox)|
|mitre-attack|enterprise-attack|Windows|T1021.001|Remote Desktop Protocol|

APT3 enables the Remote Desktop Protocol for persistence.(Citation: aptsim)

APT3 has also interacted with compromised systems to browse and copy files through RDP sessions.(Citation: Twitter Cglyer Status Update APT3 eml)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers|T1069|Permission Groups Discovery|

APT3 has a tool that can enumerate the permissions associated with Windows groups.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027|Obfuscated Files or Information|
APT3 obfuscates files or information to help evade defensive measures.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Network|T1049|System Network Connections Discovery|

APT3 has a tool that can enumerate current network connections.(Citation: Symantec Buckeye)(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1078.002|Domain Accounts|

APT3 leverages valid accounts after gaining credentials for use within the victim domain.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

APT3 has been known to stage files for exfiltration in a single location.(Citation: aptsim)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

APT3 has used a keylogging tool that records keystrokes in encrypted files.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

APT3 has used a tool to dump credentials by injecting itself into lsass.exe and triggering with the argument "dig."(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

APT3 has used a tool that can obtain info about local and global group users, power users, and administrators.(Citation: Symantec Buckeye)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|A keylogging tool used by

APT3 gathers network information from the victim, including the MAC address, IP address, WINS, DHCP server, and gateway.(Citation: Symantec Buckeye)(Citation: evolution of pirpi)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1104|Multi-Stage Channels|An
APT3 downloader first establishes a SOCKS5 connection to 192.157.198[.]103 using TCP port 1913; once the server response is verified, it then requests a connection to 192.184.60[.]229 on TCP port 81.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Windows|T1053.005|Scheduled Task|An

APT3 downloader creates persistence by creating the following scheduled task:

APT3 downloader uses the Windows command

APT3 downloader establishes SOCKS5 connections for its initial C2.(Citation: FireEye Operation Double Tap)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1033|System Owner/User Discovery|An

APT3 downloader uses the Windows command

APT3 has used PowerShell on victim systems to download and run payloads after exploitation.(Citation: FireEye Operation Double Tap)|
APT30 - G0013

Created: 2017-05-31T21:31:51.026Z

Modified: 2020-07-29T19:34:28.999Z

Contributors:

Aliases

APT30

Description

APT30 is a threat group suspected to be associated with the Chinese government. While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.(Citation: FireEye APT30)(Citation: Baumgartner Golovkin Naikon 2015)

Techniques Used

|Matrix|Domain|Platform|Technique ID|Technique Name|Use|
| :---| :---| :---| :---| :---| :---|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|APT30 has used spearphishing emails with malicious DOC attachments.(Citation: FireEye APT30)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|APT30 has relied on users to execute malicious file attachments delivered via spearphishing emails.(Citation: FireEye APT30)|
APT32 - G0050

Created: 2017-12-14T16:46:06.044Z

Modified: 2023-03-21T21:04:18.158Z

Contributors: Romain Dumont, ESET

Aliases

APT32,SeaLotus,OceanLotus,APT-C-00

Description

APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.(Citation: FireEye APT32 May 2017)(Citation: Volexity OceanLotus Nov 2017)(Citation: ESET OceanLotus)

Techniques Used

APT32's backdoor has stored its configuration in a registry key.(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

APT32 has used the

APT32 has obtained and used tools such as

Mimikatz and

Cobalt Strike, and a variety of other open-source tools from GitHub.(Citation: FireEye APT32 May 2017)(Citation: Cybereason Oceanlotus May 2017)|
|mitre-attack|enterprise-attack|PRE|T1608.001|Upload Malware|

APT32 has hosted malicious payloads in Dropbox, Amazon S3, and Google Drive for use during targeting.(Citation: Volexity Ocean Lotus November 2020)|
|mitre-attack|enterprise-attack|PRE|T1608.004|Drive-by Target|

APT32 has stood up websites containing numerous articles and content scraped from the Internet to make them appear legitimate, but some of these pages include malicious JavaScript to profile the potential victim or infect them via a fake software update.(Citation: Volexity Ocean Lotus November 2020)|
|mitre-attack|enterprise-attack|PRE|T1589|Gather Victim Identity Information|
APT32 has conducted targeted surveillance against activists and bloggers.(Citation: Amnesty Intl. Ocean Lotus February 2021)|
|mitre-attack|enterprise-attack|PRE|T1589.002|Email Addresses|

APT32 has collected e-mail addresses for activists and bloggers in order to target them with spyware.(Citation: Amnesty Intl. Ocean Lotus February 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

APT32 has used Dropbox, Amazon S3, and Google Drive to host malicious downloads.(Citation: Volexity Ocean Lotus November 2020)|
|mitre-attack|enterprise-attack|PRE|T1598.003|Spearphishing Link|

APT32 has used malicious links to direct users to web pages designed to harvest credentials.(Citation: Volexity Ocean Lotus November 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.006|Web Services|

APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.(Citation: Volexity Ocean Lotus November 2020)|
|mitre-attack|enterprise-attack|PRE|T1583.001|Domains|

APT32 has set up and operated websites to gather information and deliver malware.(Citation: Volexity Ocean Lotus November 2020)|
|mitre-attack|enterprise-attack|PRE|T1585.001|Social Media Accounts|

APT32 has set up Facebook pages in tandem with fake websites.(Citation: Volexity Ocean Lotus November 2020)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.007|JavaScript|

APT32 has used JavaScript for drive-by downloads and C2 communications.(Citation: Cybereason Cobalt Kitty 2017)(Citation: Volexity Ocean Lotus November 2020)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|
APT32 has used COM scriptlets to download Cobalt Strike beacons.(Citation: Cybereason Cobalt Kitty 2017) |
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

APT32 has abused the PasswordChangeNotify to monitor for and capture account password changes.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Containers|T1036|Masquerading|

APT32 has disguised a Cobalt Strike beacon as a Flash Installer.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

APT32 has lured targets to download a Cobalt Strike beacon by including a malicious link within spearphishing emails.(Citation: Cybereason Cobalt Kitty 2017)(Citation: Volexity Ocean Lotus November 2020)(Citation: Amnesty Intl. Ocean Lotus February 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1055|Process Injection|

APT32 malware has injected a Cobalt Strike beacon into Rundll32.exe.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1218.011|Rundll32|

APT32 malware has used rundll32.exe to execute an initial infection process.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1135|Network Share Discovery|

APT32 used the

APT32 has deployed tools after moving laterally using administrative accounts.(Citation: Cybereason Cobalt Kitty 2017) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1571|Non-Standard Port|An

APT32 backdoor can use HTTP over a non-standard TCP port (e.g 14146) which is specified in the backdoor configuration.(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Windows|T1543.003|Windows Service|
APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system.

APT32 also creates a Windows service to establish persistence.(Citation: ESET OceanLotus)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1003|OS Credential Dumping|

APT32 used GetPassword_x64 to harvest credentials.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1552.002|Credentials in Registry|

APT32 used Outlook Credential Dumper to harvest credentials stored in Windows registry.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1087.001|Local Account|

APT32 enumerated administrative users using the commands

APT32 has moved and renamed pubprn.vbs to a .txt file to avoid detection.(Citation: Twitter ItsReallyNick APT32 pubprn Masquerade)|
|mitre-attack|enterprise-attack|Windows,Linux,macOS|T1036.004|Masquerade Task or Service|

APT32 has used hidden or non-printing characters to help masquerade service names, such as appending a Unicode no-break space character to a legitimate service name.

APT32 has also impersonated the legitimate Flash installer file name "install_flashplayer.exe".(Citation: FireEye APT32 May 2017)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

APT32 has used macros, COM scriptlets, and VBS scripts.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017) |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.003|Mail Protocols|
APT32 has used email for C2 via an Office macro.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1048.003|Exfiltration Over Unencrypted Non-C2 Protocol|

APT32's backdoor can exfiltrate data by encoding it in the subdomain field of DNS packets.(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1564.003|Hidden Window|

APT32 has used the WindowStyle parameter to conceal

PowerShell windows. (Citation: FireEye APT32 May 2017) (Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1059.003|Windows Command Shell|

APT32 has used cmd.exe for execution.(Citation: Cybereason Cobalt Kitty 2017) |
|mitre-attack|enterprise-attack|macOS,Linux|T1222.002|Linux and Mac File and Directory Permissions Modification|

APT32's macOS backdoor changes the permission of the file it wants to execute to 755.(Citation: ESET OceanLotus macOS April 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

APT32's macOS backdoor can receive a “delete” command.(Citation: ESET OceanLotus macOS April 2019)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1564.001|Hidden Files and Directories|

APT32's macOS backdoor hides the clientID file via a chflags function.(Citation: ESET OceanLotus macOS April 2019)|
|mitre-attack|enterprise-attack|Windows|T1569.002|Service Execution|

APT32's backdoor has used Windows services as a way to execute its malicious payload. (Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Windows|T1112|Modify Registry|
APT32's backdoor has modified the Windows Registry to store the backdoor's configuration. (Citation: ESET OceanLotus Mar 2019)   |
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1560|Archive Collected Data|

APT32's backdoor has used LZMA compression and RC4 encryption before exfiltration.(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Windows|T1012|Query Registry|

APT32's backdoor can query the Windows Registry to gather system information. (Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1083|File and Directory Discovery|

APT32's backdoor possesses the capability to list files and directories on a machine. (Citation: ESET OceanLotus Mar 2019)

APT32's backdoor has exfiltrated data using the already opened channel with its C&C server.(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Linux,Windows,macOS|T1203|Exploitation for Client Execution|

APT32 has used RTF document that includes an exploit to execute malicious code. (CVE-2017-11882)(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Windows,Office 365|T1137|Office Application Startup|

APT32 have replaced Microsoft Outlook's VbaProject.OTM file to install a backdoor macro for persistence.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1003.001|LSASS Memory|

APT32 used Mimikatz and customized versions of Windows Credential Dumper to harvest credentials.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|
APT32 established persistence using Registry Run keys, both to execute PowerShell and VBS scripts as well as to execute their backdoor directly.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)(Citation: ESET OceanLotus Mar 2019)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

APT32 has sent spearphishing emails containing malicious links.(Citation: ESET OceanLotus)(Citation: Cybereason Oceanlotus May 2017)(Citation: FireEye APT32 April 2020)(Citation: Volexity Ocean Lotus November 2020)(Citation: Amnesty Intl. Ocean Lotus February 2021)|
|mitre-attack|enterprise-attack|Windows|T1218.005|Mshta|

APT32 has used mshta.exe for code execution.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1016|System Network Configuration Discovery|

APT32 used the

APT32 used the

APT32 has enumerated DC servers using the command

APT32 used NTFS alternate data streams to hide their payloads.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1047|Windows Management Instrumentation|

APT32 used WMI to deploy their tools on remote machines and to gather information about the Outlook process.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows|T1550.002|Pass the Hash|

APT32 has used pass the hash for lateral movement.(Citation: Cybereason Cobalt Kitty 2017)|
|mitre-attack|enterprise-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|