QCRI/TechniqueRAG-Datasets huggingface dataset:
Threat description: After this, the Carbanak backdoor can then be used to log keystrokes and capture screenshots, steal and delete cookies, inject malicious code on sites, and monitor various traffic. For lateral movement, the malware abuses remote and system administration tools.
MITRE ATT&CK techniques:
- T1056.003: Input Capture - Web Portal Capture
- T1550.004: Use Alternate Authentication Material - Web Session Cookie
- T1113: Screen Capture
- T1539: Steal Web Session Cookie
- T1020.001: Automated Exfiltration - Traffic Duplication
Threat description: FIN7 gathers information on network shares.
MITRE ATT&CK techniques:
- T1039: Data from Network Shared Drive
Threat description: The other infection chain involves an attached .XLS file containing an Excel formula that utilizes a PowerShell command (Figure 2) to access paste.ee, a Pastebin alternative, that accesses a second encrypted PowerShell command (Figure 3).
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1059: Command and Scripting Interpreter
- T1566.001: Phishing - Spearphishing Attachment
Threat description: In Carbanak attacks, the groups’ attacks can involve logging into services that accept remote connections and using stolen password hashes through the “pass the hash” method
MITRE ATT&CK techniques:
- T1110.002: Brute Force - Password Cracking
- T1550.002: Use Alternate Authentication Material - Pass the Hash
Threat description: On the other hand, FIN7 takes advantage of Mshta, a utility that can execute VBScript, and scheduled tasks to run malicious code on user systems.
MITRE ATT&CK techniques:
- T1218.005: System Binary Proxy Execution - Mshta
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: In both Carbanak and FIN7 attacks, communication with users’ compromised systems is done through bypassing firewalls or network detection systems via commonly used ports, using connection proxies to avoid direct connections to the threat group’s infrastructure, employing the command-and-control channel to remotely copy files from an external system, blending in with existing network traffic by using standard application layer protocol, and taking advantage of standard cryptographic protocol to disguise command-and-control traffic.
MITRE ATT&CK techniques:
- T1090: Proxy
Threat description: Panda Stealer is deployed through spam emails posing as business quote requests to lure unwary victims into opening malicious Excel files. We have identified two infection chains: in one, an .XLSM attachment contains macros that download a loader (Figure 1). Then, the loader downloads and executes the main stealer. 
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1137.001: Office Application Startup - Office Template Macros
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Decoding these PowerShell scripts revealed that they are used to access paste.ee URLs for easy implementation of fileless payloads. The CallByName export function in Visual Basic is used to call the load of a .NET assembly within memory from a paste.ee URL.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1059.005: Command and Scripting Interpreter - Visual Basic
Threat description: Carbanak also collects information on accounts, files and directories, group permissions, and registries.
MITRE ATT&CK techniques:
- T1083: File and Directory Discovery
Threat description: FIN7 utilizes guardrails to restrict execution and abused utilities that allow indirect command execution that can go past security restrictions
MITRE ATT&CK techniques:
- T1480: Execution Guardrails
Threat description: After moving through the network and identifying assets to target, the next step would be to gather key data. At the collection phase, Carbanak and FIN7 campaigns harvest data from local system sources and through input and screen capture (as performed in a related campaign using the Tirion malware).
MITRE ATT&CK techniques:
- T1056: Input Capture
- T1113: Screen Capture
Threat description: Cobalt Strike was also used to continuously communicate with the main command-and-control (C&C) server.
MITRE ATT&CK techniques:
- T1583.004: Acquire Infrastructure - Server
- T1587.001: Develop Capabilities - Malware
Threat description: This example of BazarLoader generated command and control (C2) activity, retrieving BazarBackdoor using HTTPS traffic from 104.248.174[.]225 over TCP port 443.
MITRE ATT&CK techniques:
- T1043: Commonly Used Port
Threat description: Use the latest attack patterns, Kubernetes (K8s) or Docker API targeting, which were featured in two reports focusing on TeamTNT operations, Black-T: New Cryptojacking Variant from TeamTNT and Hildegard: New TeamTNT Cryptojacking Malware Targeting Kubernetes.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: The attacker then executed a persistent malicious PowerShell code that was used to download and execute another PowerShell backdoor file in the server from the malicious IP address 185[.]82[.]219[.]201, as shown in Figure 7.
MITRE ATT&CK techniques:
- T1590.005: Gather Victim Network Information - IP Addresses
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1064: Scripting
- T1546.013: Event Triggered Execution - PowerShell Profile
- T1027.003: Obfuscated Files or Information - Steganography
- T1216: System Script Proxy Execution
- T1059: Command and Scripting Interpreter
Threat description: The PowerShell command executed after the Microsoft Exchange exploitation is responsible for downloading and executing another PowerShell script from the command-and-control (C&C) server 185[.]82[.]219[.]201
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1064: Scripting
- T1546.013: Event Triggered Execution - PowerShell Profile
- T1059: Command and Scripting Interpreter
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
Threat description: In our case study, approximately two minutes after Cobalt Strike activity started, a tool to enumerate an AD environment appeared on the infected host at C:\ProgramData\AdFind.exe.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
- T1595: Active Scanning
Threat description: Our analysis shows that the Crimson RAT malware is compiled as a .NET binary with minimal obfuscation. This could indicate that the cybercriminal group behind this campaign is possibly not well-funded.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
- T1588.001: Obtain Capabilities - Malware
- T1001: Data Obfuscation
- T1140: Deobfuscate/Decode Files or Information
Threat description: Earth Karkaddan actors are known to use the Crimson RAT malware in its campaigns to communicate with its command-and-control (C&C) server to download other malware or exfiltrate data.
MITRE ATT&CK techniques:
- T1583.004: Acquire Infrastructure - Server
- T1588.001: Obtain Capabilities - Malware
- T1587.001: Develop Capabilities - Malware
Threat description: After downloading and executing these files, one of the child processes created other files and the executable setup.exe/setup-installv1.3.exe, which was extracted from 320yea_Teamviewer_15206.zip via WinRAR.exe. This file seems to be the source of most of the downloaded malicious files, as seen in the following figure.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
Threat description: The BazarLoader DLL was immediately copied to another location and made persistent through the Windows registry
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1543.003: Create or Modify System Process - Windows Service
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: These infections provide backdoor access that criminals use to determine whether the host is part of an Active Directory (AD) environment. If so, criminals deploy Cobalt Strike and perform reconnaissance to map the network
MITRE ATT&CK techniques:
- T1592: Gather Victim Host Information
- T1595: Active Scanning
Threat description: The malicious Excel spreadsheet was discovered on Wednesday, Aug. 18, 2021, and it has a last modified date of Tuesday, Aug. 17. The filename had an .xlsb file extension. This file has macros designed to infect a vulnerable Windows host with BazarLoader. Figure 2 shows a screenshot of the Excel file.
MITRE ATT&CK techniques:
- T1137.001: Office Application Startup - Office Template Macros
- T1588.001: Obtain Capabilities - Malware
- T1587.001: Develop Capabilities - Malware
Threat description: Once the executable file is executed, it will proceed to unzip a file named mdkhm.zip and then execute a Crimson RAT executable named dlrarhsiva.exe.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: BazarLoader is Windows-based malware spread through various methods involving email
MITRE ATT&CK techniques:
- T1534: Internal Spearphishing
- T1566: Phishing
- T1566.001: Phishing - Spearphishing Attachment
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1588.001: Obtain Capabilities - Malware
- T1587.001: Develop Capabilities - Malware
- T1566.002: Phishing - Spearphishing Link
Threat description: The loaded module is a simple dropper. Upon loading the module, the AutoOpen method will be invoked. The malicious code in this method drops the final payload executable into %AppData%\service.exe and executes it (see Figure 6)
MITRE ATT&CK techniques:
- T1574.005: Hijack Execution Flow - Executable Installer File Permissions Weakness
- T1543.003: Create or Modify System Process - Windows Service
- T1574: Hijack Execution Flow
- T1569.002: System Services - Service Execution
Threat description: The spreadsheet’s macro code retrieved a malicious Dynamic Link Library (DLL) file for BazarLoader from the following URL
MITRE ATT&CK techniques:
- T1204.001: User Execution - Malicious Link
Threat description:  this Excel template was created by a threat actor trying to instill confidence by taking advantage of the DocuSign brand name and image.
MITRE ATT&CK techniques:
- T1221: Template Injection
- T1137.001: Office Application Startup - Office Template Macros
Threat description: Crimson RAT can steal credentials from browsers, collect antivirus information, capture screenshots, and list victim drives, processes, and directories. We have observed how an infected host communicates with a Crimson RAT C&C server to send exfiltrated information including PC name, operating system (OS) information, and the location of the Crimson RAT malware inside the system.
MITRE ATT&CK techniques:
- T1592: Gather Victim Host Information
- T1555.003: Credentials from Password Stores - Credentials from Web Browsers
- T1003: OS Credential Dumping
- T1113: Screen Capture
- T1125: Video Capture
- T1056: Input Capture
- T1590: Gather Victim Network Information
- T1589: Gather Victim Identity Information
Threat description: Cobalt Strike leads to reconnaissance of an infected host’s environment. In our lab environments, this reconnaissance activity can start within a few minutes after Cobalt Strike traffic first appears.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
- T1587.001: Develop Capabilities - Malware
Threat description: In this case, a Cobalt Strike DLL file was sent through Bazar C2 traffic and saved to the infected Windows host under the user’s AppData\Roaming directory
MITRE ATT&CK techniques:
- T1564.003: Hide Artifacts - Hidden Window
Threat description: Cobalt Strike is an adversary simulation platform developed for penetration testers by Raphael Mudge, founder of Strategic Cyber LLC. Designed for interoperability with other platforms such as Metasploit, NMAP, and Powershell Empire, it can be run using Armitage, a graphic user interface (GUI) developed by Mudge, initially for Metasploit. Armitage and Cobalt Strike are designed around a team server that allows for the sharing of information and the ability to direct and execute well-coordinated actions.
MITRE ATT&CK techniques:
- T1061: Graphical User Interface
Threat description: Even though network monitoring and detection capabilities do not come easy for many organizations, they can generally offer a high return on investment if implemented correctly. Malware has to contact its C2 server if it is to receive further instructions. This article will demonstrate how to detect this communication before threat actors accomplish their objectives. There are a couple of factors that we can utilize to fingerprint any suspicious traffic and subsequent infrastructure. Before we get into that part, we should first discuss what makes Cobalt Strike so versatile.
MITRE ATT&CK techniques:
- T1102.002: Web Service - Bidirectional Communication
- T1102.003: Web Service - One-Way Communication
Threat description: Fifteen minutes after domain enumeration, we observed successful lateral movement to two endpoints on the network. Ten minutes after lateral movement, a PowerShell Cobalt Strike loader executed as a service on a server. Even though the execution was not successful, the threat actors kept trying, a total of eight times, until it finally worked. Windows Defender real-time monitoring was then disabled, the LSASS.exe process was dumped using SysInternals ProcDump, and privilege was escalated to “SYSTEM” using named pipe impersonation. 
MITRE ATT&CK techniques:
- T1546.013: Event Triggered Execution - PowerShell Profile
- T1068: Exploitation for Privilege Escalation
- T1569.002: System Services - Service Execution
Threat description: As days go by, more of the reported ransomware attacks turn out to be related to the new Pay2Key ransomware. The attacker followed the same procedure to gain a foothold, propagate and remotely control the infection within the compromised companies.
MITRE ATT&CK techniques:
- T1189: Drive-by Compromise
Threat description: SUGARDUMP using SMTP for C2 communication – dated to late 2021-early 2022. This variant was downloaded from a known UNC3890 C2 (URL: hxxp://128.199.6[.]246/3-Video-VLC.exe), and is a slightly more advanced version with similar credential harvesting functionality. 
MITRE ATT&CK techniques:
- T1041: Exfiltration Over C2 Channel
Threat description: Essentially, the TDSS botnet kad.dll module is more or less the same as cmd.dll in terms of control function. By running nodes.dat files containing a list of IP addresses of Kad clients in addition to ktzerlrules, which contains a command to download a new nodes.dat file from cybercriminal servers, the owners of the botnet can both include their infected computers in the publicly accessible Kad network and remove them from the network. The publicly accessible Kad network contains no more than 10 TDSS infected computers. This makes replacing the ktzerules file as inefficient as possible, which prevents other cybercriminals from taking control over the botnet. The total number of TDSS infected computers on the closed network number tens of thousands.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1588.001: Obtain Capabilities - Malware
- T1587.001: Develop Capabilities - Malware
Threat description: We can apply this same concept across other executable traits, such as BOOSTWRITE’s export DLL name (DWriteImpl.dll), to create quick and easy rules that can aid in quick discovery as seen in Figure 7.
MITRE ATT&CK techniques:
- T1129: Shared Modules
Threat description: HenBox attempts to hide itself from the app launcher view by running the following code, passing the parameters COMPONENT_ENABLED_STATE_DISABLED (2) and DONT_KILL_APP (1) to the setComponentEnabledSetting() method.
MITRE ATT&CK techniques:
- T1564: Hide Artifacts
Threat description: As our research technique of fingerprinting exploit writers exceeded our initial expectations, we were on the lookout for more exploits to investigate. Soon enough, we came across this blog post from Kaspersky detailing how Sodin (a.k.a Sodinokibi, or REvil), an infamous ransomware, is using a 1-Day exploit for CVE-2018-8453.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
- T1210: Exploitation of Remote Services
- T1588.006: Obtain Capabilities - Vulnerabilities
Threat description: The first spear phish from group “Admin@338” was sent to a foreign government in the Asian Pacific region on March 10, 2014 – just two days after the flight disappeared. The threat actors sent a spear-phishing email with an attachment titled, “Malaysian Airlines MH370.doc” (MD5: 9c43a26fe4538a373b7f5921055ddeae). Although threat actors often include some sort of “decoy content” upon successful exploitation (that is, a document representing what the recipient expected to open), in this case, the user is simply shown a blank document.
MITRE ATT&CK techniques:
- T1566: Phishing
- T1566.001: Phishing - Spearphishing Attachment
- T1203: Exploitation for Client Execution
Threat description: However, for version 3 things are different.  This is how the report of the email_accounts_grabber module appears for Emotet version 3:
MITRE ATT&CK techniques:
- T1586.002: Compromise Accounts - Email Accounts
- T1588.001: Obtain Capabilities - Malware
- T1129: Shared Modules
Threat description: APT3 (also known as UPS), the actors responsible for Operation Clandestine Fox has quietly continued to send waves of spearphishing messages over the past few months. This actor initiated their most recent campaign on November 19, 2014 targeting multiple organizations. The attacker leveraged multiple exploits, targeting both CVE-2014-6332 and CVE-2014-4113. CVE-2014-6332 was disclosed publicly on 2014-11-11 and is a Windows OLE Automation Array Remote Code Execution vulnerability. CVE-2014-4113 is a privilege escalation vulnerability that was disclosed publicly on 2014-10-14.
MITRE ATT&CK techniques:
- T1534: Internal Spearphishing
- T1587.004: Develop Capabilities - Exploits
- T1566.003: Phishing - Spearphishing via Service
Threat description: In March, we discovered a targeted campaign to distribute Milum, a Trojan designed to gain remote control of devices in target organizations, some of which operate in the industrial sector. The first signs of this operation, which we have dubbed WildPressure, can be traced back to August 2019; still, the campaign remains active. The Milum samples we have seen so far do not share any code similarities with any known APT campaigns. The malware provides attackers with remote control over infected devices, allows downloading and executing commands, collecting and exfiltrating information and installing upgrades in the malware.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: We did not observe the initial access for this case but assess with medium to high confidence that a malicious email campaign was used to deliver an Excel (xls) document. Following the opening of the xls document, the initial Qbot DLL loader was downloaded and saved to disk. Interestingly, the name of the DLL contained a .html extension to disguise the portable executable nature of the payload. Once executed, the Qbot process creates a scheduled task to elevate itself to system.
MITRE ATT&CK techniques:
- T1204.002: User Execution - Malicious File
- T1566.002: Phishing - Spearphishing Link
- T1566.001: Phishing - Spearphishing Attachment
Threat description: Although there are no previously known malicious Android applications attributed to the StrongPity group, we strongly believe that the threat actor is in the process of actively developing new malicious components that can be used to target Android platforms.
MITRE ATT&CK techniques:
- T1505: Server Software Component
Threat description: SHA256 file hashes for 119 malspam attachments, 30 extracted Redaman executable files, and 30 dropped Redaman DLL files found from September through December 2018. Information is available at: https://github.com/pan-unit42/iocs/blob/master/Redaman_banking_malware/2018-09-thru-2018-12-file-hashes-for-Redaman-banking-malware.txt .
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1566.001: Phishing - Spearphishing Attachment
Threat description: According to our research partner in Japan, the original EvilPost attack in December 2015 arrived as a spear-phishing email with a Word document attached.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1566.001: Phishing - Spearphishing Attachment
Threat description: In early April, Emotet acquired a module for distribution over wireless networks (MD5: 75d65cea0a33d11a2a74c703dbd2ad99), which tried to access Wi-Fi using a dictionary attack. Its code resembled that of the Network Spreader module (bypass.exe), which had been supplemented with Wi-Fi connection capability. If the brute-force was successful, the module transmitted data about the network to C&C.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: We investigated a long-running espionage campaign, dubbed A41APT, targeting multiple industries, including the Japanese manufacturing industry and its overseas bases, which has been active since March 2019. The attackers used vulnerabilities in an SSL-VPN product to deploy a multi-layered loader we dubbed Ecipekac (aka DESLoader, SigLoader and HEAVYHAND). We attribute this activity to APT10 with high confidence. Most of the discovered payloads deployed by this loader are fileless and have not been seen before. We observed SodaMaster (aka DelfsCake, dfls and DARKTOWN), P8RAT (aka GreetCake and HEAVYPOT), and FYAnti (aka DILLJUICE Stage 2) which in turn loads QuasarRAT. In November and December 2020, two public blog posts were published about this campaign. One month later, we observed new activities from the actor with an updated version of some of their implants designed to evade security products and make analysis harder for researchers. You can read more in our public report.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
- T1588.006: Obtain Capabilities - Vulnerabilities
Threat description: Along with the HTTP part, the binary part was also updated. The encryption remained the same, but Emotet dropped Google Protocol Buffer and switched to its own format. The compression algorithm also changed, with zlib replaced by liblzf. More details about the new protocol can be found in the Threat Intel and CERT Polska reports.
MITRE ATT&CK techniques:
- T1048.003: Exfiltration Over Alternative Protocol - Exfiltration Over Unencrypted Non-C2 Protocol
Threat description: In November 2018, Cisco Talos published research on an attack campaign named DNSpionage. It involved attacks using malware to compromise individual endpoints, but most interestingly described an effort to specifically hijack DNS entries of government organizations to redirect visitors to likely malicious, adversary operated systems. Both FireEye and Crowdstrike followed up with their own assessments for the DNS hijacking efforts, and described operations extending back to January 2017. No attribution to any known adversary groups was provided, other than that the target radius was primarily in the Middle East and the adversary was also likely operating out of that region. 
MITRE ATT&CK techniques:
- T1496: Resource Hijacking
- T1584.002: Compromise Infrastructure - DNS Server
- T1189: Drive-by Compromise
- T1583.002: Acquire Infrastructure - DNS Server
Threat description: Although the targeting profile is the same as the Russian banking cluster, the TTPs are very different. In particular, the use of tooling stands out from other clusters of CARBON SPIDER activity. As with other clusters, the primary infection vector is targeted spear phishing emails that use exploits for a variety of vulnerabilities in Microsoft Office:
MITRE ATT&CK techniques:
- T1588.006: Obtain Capabilities - Vulnerabilities
- T1566: Phishing
- T1203: Exploitation for Client Execution
Threat description: 1) Function similarity – Important functions in both BYEBY and wincore.dll have almost the same implementation. One such function is the payloads’ main thread function.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
- T1055.003: Process Injection - Thread Execution Hijacking
Threat description: Another indicator of a Qakbot infection is HTTPS traffic to cdn.speedof[.]me. The domain speedof[.]me is used by a legitimate Internet speed test service. Although this is not malicious traffic, we frequently see traffic to cdn.speedof[.]me during Qakbot infections. Figure 20 shows this activity from our pcap.
MITRE ATT&CK techniques:
- T1090.004: Proxy - Domain Fronting
Threat description: Malicious use of Responder was first publicly documented on August 11, 2017 as being used by APT28, also known as Fancy Bear. The tool was used against hotel visitors to spoof NetBios resources. Victims were coerced into connecting to UDP port 137 and disclosing credentials over SMB to APT28, which the threat actor then used to gain elevated access to the network.
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
- T1043: Commonly Used Port
- T1557.001: Adversary-in-the-Middle - LLMNR/NBT-NS Poisoning and SMB Relay
Threat description: Next we compared the codebase for setting registry keys. The code reuse displayed in Figure 4 is the sequence that sets the IEHarden registry keys and other keys used throughout TidePool and Operation Ke3chang malware.
MITRE ATT&CK techniques:
- T1112: Modify Registry
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: Another infamous banker Trojan, Kronos, caught up with Edge in 2016. We checked out its capabilities on a Windows 10 virtual machine. In the code of the new Kronos version we found a function that checks the name and checksum of a process, as well as the hashes of the functions hooked by the malware.
MITRE ATT&CK techniques:
- T1056.004: Input Capture - Credential API Hooking
Threat description: CARROTBALL, initially discovered in an attack during October 2019, is a simple FTP downloader utility which facilitates the installation of SYSCON, a full-featured Remote Access Trojan (RAT) which leverages FTP for Command and Control (C2). It was found embedded in a malicious Word document sent as a phishing lure to a US government agency and two non-US foreign nationals professionally associated with North Korea.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1566: Phishing
Threat description: The success of the Dropping Elephant group is striking given that no zero-day exploits or advanced techniques were used to target high-profile victims – it’s clear that by applying security updates and improving the security awareness of staff, the success of attacks like this can be prevented. At the start of the year we predicted that APT groups would invest less effort in developing sophisticated tools and make greater use of off-the-shelf malware. Dropping Elephant provides a further example of how low investment and use of ready-made toolsets can be very effective when combined with high quality social engineering.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: In early 2015, a new Emotet modification was released, not all that different from the previous one. Among the changes were: new built-in public RSA key, most strings encrypted, ATS scripts for web injection cleared of comments, targets included clients of Swiss banks.
MITRE ATT&CK techniques:
- T1592.004: Gather Victim Host Information - Client Configurations
Threat description: A C&C address (103.82.52[.]18) which was found in one of MosaicRegressor’s variants (MD5:3B58E122D9E17121416B146DAAB4DB9D) was observed in use by the ‘Winnti umbrella and linked groups’, according to a publicly available report. Since this is the only link between our findings and any of the groups using the Winnti backdoor, we estimate with low confidence that it is indeed responsible for the attacks.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: Both MPK variants include key loggers that are extremely similar in functionality in addition to having the same strings used for headers within the key log file. The MPK IRC Bot monitors active application windows and writes the title of the open window along with the logged keystrokes to a file at “%temp%\Save.tmp”. The MPK Trojan also monitors specifically for windows that are likely to contain login forms for popular web-based email clients, such as titles that contain:
MITRE ATT&CK techniques:
- T1554: Compromise Host Software Binary
Threat description: AveMaria is a new botnet, whose first version we found in September 2018, right after the arrests of the FIN7 members. We have medium confidence that this botnet falls under the FIN7 umbrella. In fact, AveMaria is a classic infostealer bot that collects all possible credentials from various types of software: browsers, email clients, messengers, etc., and can act as a keylogger. Since the beginning of 2019, we have collected more than 1300 samples and extracted more than 130 C2s.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
- T1114: Email Collection
Threat description: . . MuddyWater has conducted various campaigns against entities spread throughout the U.S.A, Europe, Middle East and South Asia.. . A typical TTP employed by the group is the heavy use of scripting in their infection chains using languages like PowerShell and Visual Basic coupled with the frequent use of living-of-the-land binaries (LoLBins).. . Cisco Talos recently observed a campaign operated by MuddyWater targeting users in Turkey. This campaign consists of the use of malicious PDFs and Microsoft Office documents (maldocs) to serve as the initial infection vector. These maldocs were named in such a way as to masquerade as legitimate documents from the Turkish Health and Interior Ministries.. . Next, the malware executes a series of scripts deployed on the infected endpoint to serve as downloaders and instrumentors for additional payloads.. . We've also discovered the use of flags or tokens in attacks conducted by this threat actor in this campaign. These tokens are meant to signal a successful infection of a target by the group's malicious artifacts.. . . . 
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: Pony is a popular downloader program that can download additional malware onto the infected system. It is also equipped with a number of plugins that may be used to steal stored credentials for various applications such as FTP clients, web browsers, email clients, and other software. Pony is also commonly known as Fareit.
MITRE ATT&CK techniques:
- T1555: Credentials from Password Stores
- T1539: Steal Web Session Cookie
Threat description: We determined the string in the pre tags is the actor provided password, which the webshell uses as a key to decrypt the embedded payload. We determined this by following the process in which the TwoFace++ loader webshell uses the actor provided password to authenticate and decrypt the embedded webshell:
MITRE ATT&CK techniques:
- T1552.004: Unsecured Credentials - Private Keys
Threat description: We found a Coinminer bundled with the legitimate installer of video conferencing app Zoom, luring users who want to install the software but end up unwittingly downloading a malicious file. The compromised files are not from Zoom’s official download center, and are assumed to come from fraudulent websites. We have been working with Zoom to ensure that they are able to communicate this to their users appropriately.
MITRE ATT&CK techniques:
- T1195.002: Supply Chain Compromise - Compromise Software Supply Chain
- T1554: Compromise Host Software Binary
- T1588.001: Obtain Capabilities - Malware
- T1574.005: Hijack Execution Flow - Executable Installer File Permissions Weakness
Threat description: In August 2019, FireEye released the “Double Dragon” report on our newest graduated threat group, APT41. A China-nexus dual espionage and financially-focused group, APT41 targets industries such as gaming, healthcare, high-tech, higher education, telecommunications, and travel services. APT41 is known to adapt quickly to changes and detections within victim environments, often recompiling malware within hours of incident responder activity. In multiple situations, we also identified APT41 utilizing recently-disclosed vulnerabilities, often weaponzing and exploiting within a matter of days.
MITRE ATT&CK techniques:
- T1595.002: Active Scanning - Vulnerability Scanning
- T1046: Network Service Discovery
Threat description: Most modifications of Trojan.Win32.Waldek are distributed via removable media and include functionality to collect information on infected systems and send it to the attackers. Based on the system data collected, the attackers create packages of additional malware to be installed on the infected system using the relevant Waldek functionality.
MITRE ATT&CK techniques:
- T1543: Create or Modify System Process
- T1005: Data from Local System
- T1025: Data from Removable Media
- T1091: Replication Through Removable Media
Threat description: LockBit 2.0 is known for its extortion tactics, encrypting devices and demanding a ransom
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
- T1486: Data Encrypted for Impact
Threat description: Vidar can also receive settings from the C&C that tells it exactly what to do.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: The threat actor used RDP on Active Directory using leaked accounts. The actor dropped scanning tools, Nmap.exe and Nping.exe, for scanning the network. Next, the scheduled task was pushed by the group policy domain machine.
MITRE ATT&CK techniques:
- T1484: Domain or Tenant Policy Modification
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: An attacker sends an e-mail with a malicious Tar archive attached.
MITRE ATT&CK techniques:
- T1598.002: Phishing for Information - Spearphishing Attachment
- T1566.001: Phishing - Spearphishing Attachment
Threat description: QAKBOT can use VBS to download and execute malicious files
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: The PHP malware achieves persistence by adding scheduled tasks on the host to execute daily and at regular intervals. At the same time, a generated TMP file runs a parallel process to launch the stealer component.
MITRE ATT&CK techniques:
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: Uses PowerShell to retrieve the malicious payload and download additional resources such as Mimikatz and Rclone.
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1588.002: Obtain Capabilities - Tool
Threat description: The observed attack technique (OAT) detection indicates that the php-cgi process represents a “/bin/bash” shell”and is directly reading “passwd”, suggesting that the server might have been compromised
MITRE ATT&CK techniques:
- T1059.004: Command and Scripting Interpreter - Unix Shell
Threat description: Uses BITSAdmin to download and install payloads.
MITRE ATT&CK techniques:
- T1588.002: Obtain Capabilities - Tool
Threat description: Sideloading happens after the steps described earlier — the threat actor successfully exploited Log4j and downloaded mfeann.exe, LockDown.DLL, and c0000012.log.
MITRE ATT&CK techniques:
- T1203: Exploitation for Client Execution
Threat description: Notably, one of the tools used in the attack exploited the CVE 2021 21551 vulnerability in a Dell driver in what was the first recorded abuse of this security flaw.
MITRE ATT&CK techniques:
- T1211: Exploitation for Defense Evasion
- T1190: Exploit Public-Facing Application
- T1588.006: Obtain Capabilities - Vulnerabilities
Threat description: The ransomware payload is copied to the ADMIN$ share of a remote system, and Impacket is used to remotely create a Windows Scheduled Task on target systems to execute the payload
MITRE ATT&CK techniques:
- T1021.002: Remote Services - SMB/Windows Admin Shares
- T1053: Scheduled Task/Job
- T1053.005: Scheduled Task/Job - Scheduled Task
Threat description: QAKBOT can maintain persistence by creating an auto-run Registry key
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
- T1547.001: Boot or Logon Autostart Execution - Registry Run Keys / Startup Folder
Threat description: The ProxyShell elevation of privilege on the Exchange PowerShell Backend (CVE-2021-34523), Windows Background Intelligent Transfer Service (BITS) improperly handling symbolic links (CVE-2020-0787), and abusing the CMSTPLUA COM interface have all been seen as methods of privilege escalation.
MITRE ATT&CK techniques:
- T1068: Exploitation for Privilege Escalation
Threat description: Interestingly, the actors chose to leverage Cobalt Strike for lateral movement. The first of several beacon files are dropped onto the same infected endpoint running Brute Ratel C4, with the first being:
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
- T1588.002: Obtain Capabilities - Tool
Threat description: QAKBOT has gained execution through users opening malicious attachments
MITRE ATT&CK techniques:
- T1204: User Execution
Threat description: The malware will ultimately be extracted to the %LocalAppData%\Packages\PXT folder, which includes the PHP.exe local interpreter, various scripts used to steal information, and supporting tools, as shown below.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1588.001: Obtain Capabilities - Malware
Threat description: Amavis analyzes the e-mail attachments and inspects the contents of the attached archive. It invokes cpio and CVE-2015-1197 is triggered.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
- T1546: Event Triggered Execution
- T1588.006: Obtain Capabilities - Vulnerabilities
Threat description: The vulnerability tracked as CVE-2022-41352 is a remote code execution flaw that allows attackers to send an email with a malicious archive attachment that plants a web shell in the ZCS server while, at the same time, bypassing antivirus checks.
MITRE ATT&CK techniques:
- T1566.001: Phishing - Spearphishing Attachment
- T1505.003: Server Software Component - Web Shell
Threat description: Cobalt Strike can use PsExec to execute a payload on a remote host. It can also use Service Control Manager to start new services
MITRE ATT&CK techniques:
- T1569.002: System Services - Service Execution
Threat description: When neither of the previous commands are received, the message is taken as a command to be executed with cmd.exe. The output is sent to the server.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1202: Indirect Command Execution
Threat description: Both Advanced Port Scanner and NetScan have been used to discover local network infrastructure devices and services running on remote hosts. Active Directory queries for remote systems have been performed by ADFind.
MITRE ATT&CK techniques:
- T1046: Network Service Discovery
Threat description: Racealer (aka RaccoonStealer) is known to be a stealer-type malware that mostly extracts user credentials and exfiltrates data from compromised machines.
MITRE ATT&CK techniques:
- T1552.001: Unsecured Credentials - Credentials In Files
- T1588.001: Obtain Capabilities - Malware
- T1020: Automated Exfiltration
Threat description: REvil reached its pinnacle of success in the first half of 2021, compromising thousands of companies in a Kaseya MSP supply-chain attack, demanding a $50 million payment from computer maker Acer, and extorting Apple using stolen blueprints of non-yet-released devices.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
- T1189: Drive-by Compromise
Threat description: QAKBOT abuses Wscript to execute a Jscript file.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: QAKBOT uses obfuscation across two script files, a JavaScript (.js) file and a Batch Script (.cmd) file, likely in an effort to conceal suspicious-looking command lines. 
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1027: Obfuscated Files or Information
- T1059.003: Command and Scripting Interpreter - Windows Command Shell
- T1059.007: Command and Scripting Interpreter - JavaScript
Threat description: Initial QAKBOT .zip file bypasses some antivirus detections due to password protections.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
- T1140: Deobfuscate/Decode Files or Information
Threat description: In rare cases, LockBit 2.0 has been observed to create accounts for persistence with simple names, such as “a.”
MITRE ATT&CK techniques:
- T1136.001: Create Account - Local Account
Threat description: Vulnerabilities such as ProxyShell (CVE-2021-34473) and improper SQL sanitization (CVE-2021-20028) have been observed being utilized as footholds into the environment.
MITRE ATT&CK techniques:
- T1190: Exploit Public-Facing Application
- T1588.006: Obtain Capabilities - Vulnerabilities
Threat description: As seen with other ransomware cases, Mimikatz is a key player in dumping credentials but LockBit 2.0 has been occasionally seen utilizing MiniDump as well.
MITRE ATT&CK techniques:
- T1003: OS Credential Dumping
Threat description: There is a command ftpversion that uploads the version of the backdoor (hardcoded) to a file `ver.txt` on the FTP server, in the root folder for the target.
MITRE ATT&CK techniques:
- T1059: Command and Scripting Interpreter
- T1105: Ingress Tool Transfer
Threat description: In early February 2022, we witnessed an intrusion employing Gootloader (aka GootKit) as the initial access vector. The intrusion lasted two days and comprised discovery, persistence, lateral movement, collection, defense evasion, credential access and command and control activity. During the post-exploitation phase, the threat actors used RDP, WMI, Mimikatz, Lazagne,… .
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: 2. The perpetrators distributed PlugX messages to employees- personal addresses, claiming to come from fellow members of staff. The letters contained photos of alleged senders. Along with the photos, all the information about personal mailboxes could have been collected during the group-s initial presence on corporate workstations.
MITRE ATT&CK techniques:
- T1598: Phishing for Information
- T1114: Email Collection
Threat description: Androrat is an open source remote management tool developed by a team of four for a university project. Open source code was upload to the GitHub website in 2012. It is a remote management tool that allows remote control of mobile devices using a computer.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: When executed, the final macro code as interpreted by CMD decodes into a classic PowerShell download cradle that fetches the initial QakBot payload. There is one last bit of obfuscation here as the script does contain two more encoded strings. One is the URL as seen above in Figure 8, and another is the full path to which the payload will initially be written: “C:\Users\Public\tmpdir\file”. 
MITRE ATT&CK techniques:
- T1059.001: Command and Scripting Interpreter - PowerShell
- T1059: Command and Scripting Interpreter
Threat description: . The attackers have also used file names and export API names in the CRAT DLLs to masquerade the RAT as a benign application's library. Some examples of the exported function names are:. 
MITRE ATT&CK techniques:
- T1140: Deobfuscate/Decode Files or Information
Threat description: The sample was first uploaded to VT on the 2018-10-12 from the Ukraine. It exhibits an encoding and a code style that are similar to those used by former series of Hades droppers. Nevertheless, it introduces new features like anti-analysis and delayed execution, which were only used by the second stage payload in the past.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: This resembled the server-side ASPX payload of the China Chopper webshell documented previously. Uploads to VirusTotal in late August 2018 resembling the same filename, iisstart.aspx, indicate the deployed webshell was likely a version of the China Chopper webshell known to have been used by several Chinese threat actors.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: If we look historically, BelialDemon has been involved in the development of malware loaders. BelialDemon is considered the primary developer of TriumphLoader, a loader previously posted about on several forums, and has experience with selling this type of malware.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: FireEye’s blog, “Highly Evasive Attacker Leverages SolarWinds Supply Chain to Compromise Multiple Global Victims with SUNBURST Backdoor,” contains a wealth of useful information, all of which has been analyzed by Unit 42 researchers to help ensure Palo Alto Networks customers are protected.
MITRE ATT&CK techniques:
- T1195: Supply Chain Compromise
Threat description: Towards the end of July, we observed an intrusion that began with IcedID malware and ended in XingLocker ransomware, a Mountlocker variant. XingLocker made its first appearance in early May of this year. The new group was featured in the AstroLocker ransomware blog, and it has been very active since then.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: In 2014, a European corporation was compromised prior to constructing a manufacturing facility in Vietnam.. In 2016, Vietnamese and foreign-owned corporations working in network security, technology infrastructure, banking, and media industries were targeted. . In mid-2016, malware that FireEye believes to be unique to APT32 was detected on the networks of a global hospitality industry developer with plans to expand operations into Vietnam.. From 2016 through 2017, two subsidiaries of U.S. and Philippine consumer products corporations, located inside Vietnam, were the target of APT32 intrusion operations.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: The first versions of these new USB stealer modules appeared around February 2015 and the latest appear to have been compiled in May 2015. Older versions of these USBSTEALER modules were previously described by our colleagues from ESET.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: While investigating some malicious activity in Central Asia, we identified a new backdoor, named Tunnus, which we attribute to Turla. This is.NET-based malware with the ability to run commands or perform file actions on an infected system and send the results to its C2. So far, the threat actor has built its C2 infrastructure with vulnerable WordPress installations.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: . . Once the second stage is extracted and run, we are presented with the final stage of this attack, which we refer to as ComboJack. Once ComboJack is extracted it begins by copying itself to the following location:
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware
Threat description: Spora ransomware, which began circulating in January of this year, is a ransomware noted for its sophistication, including top-notch customer support to victims, and was likely created by professional malicious actors.
MITRE ATT&CK techniques:
- T1588.001: Obtain Capabilities - Malware
Threat description: The 2019 Linux variant of the GoldMax backdoor is almost identical in functionality and implementation to the previously identified May 2020 Windows variant. The very few additions to the backdoor between 2019 and 2020 likely reflect its maturity and longstanding evasion of detections. It is likely GoldMax has been used as a long-term persistence backdoor during StellarParticle-related compromises, which would be consistent with the few changes made to the malware to modify existing functions or support additional functionality.
MITRE ATT&CK techniques:
- T1587.001: Develop Capabilities - Malware