sarahwei/cyber_MITRE_CTI_dataset_v15 huggingface dataset:
HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Kimsuky has registered domains to spoof targeted organizations and trusted third parties.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Leviathan has established domains that impersonate legitimate entities to use for targeting efforts.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Mustang Panda have acquired C2 domains prior to operations.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages, while also hosting these items on legitimate, compromised network infrastructure.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Silent Librarian has acquired domains to establish credential harvesting pages, often spoofing the target organization and using free top level domains .TK, .ML, .GA, .CF, and .GQ.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
TA2541 has registered domains often containing the keywords “kimjoy,” “h0pe,” and “grace,” using domain registrars including Netdorm and No-IP DDNS, and hosting providers including xTom GmbH and Danilenko, Artyom.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
TA505 has registered domains to impersonate services such as Dropbox to distribute malware.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
TeamTNT has obtained domains to host their payloads.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Threat Group-3390 has registered domains for C2.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Transparent Tribe has registered domains to mimic file sharing, government, defense, and research websites for use in targeted campaigns.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Winnti Group has registered domains for C2 that mimicked sites of their intended targets.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
ZIRCONIUM has purchased domains for use in targeted campaigns.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
menuPass has registered malicious domains for use in intrusion campaigns.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
DarkGate command and control includes hard-coded domains in the malware chosen to masquerade as legitimate services such as Akamai CDN or Amazon Web Services.
Technique: T1583.001 Acquire Infrastructure: Domains, Tactic: TA0042 Resource Development
Axiom has acquired dynamic DNS services for use in the targeting of intended victims.
Technique: T1583.002 Acquire Infrastructure: DNS Server, Tactic: TA0042 Resource Development
HEXANE has set up custom DNS servers to send commands to compromised hosts via TXT records.
Technique: T1583.002 Acquire Infrastructure: DNS Server, Tactic: TA0042 Resource Development
During the C0032 campaign, TEMP.Veles used Virtual Private Server (VPS) infrastructure.
Technique: T1583.003 Acquire Infrastructure: Virtual Private Server, Tactic: TA0042 Resource Development
APT28 hosted phishing domains on free services for brief periods of time during campaigns.
Technique: T1583.003 Acquire Infrastructure: Virtual Private Server, Tactic: TA0042 Resource Development
Axiom has used VPS hosting providers in targeting of intended victims.
Technique: T1583.003 Acquire Infrastructure: Virtual Private Server, Tactic: TA0042 Resource Development
Dragonfly has acquired VPS infrastructure for use in malicious campaigns.
Technique: T1583.003 Acquire Infrastructure: Virtual Private Server, Tactic: TA0042 Resource Development
HAFNIUM has operated from leased virtual private servers (VPS) in the United States.
Technique: T1583.003 Acquire Infrastructure: Virtual Private Server, Tactic: TA0042 Resource Development
LAPSUS$ has used VPS hosting providers for infrastructure.
Technique: T1583.003 Acquire Infrastructure: Virtual Private Server, Tactic: TA0042 Resource Development
During Night Dragon, threat actors purchased hosted services to use for C2.
Technique: T1583.004 Acquire Infrastructure: Server, Tactic: TA0042 Resource Development
During Operation Dream Job, Lazarus Group acquired servers to host their malicious tools.
Technique: T1583.004 Acquire Infrastructure: Server, Tactic: TA0042 Resource Development
For Operation Honeybee, at least one identified persona was used to register for a free account for a control server.
Technique: T1583.004 Acquire Infrastructure: Server, Tactic: TA0042 Resource Development
For Operation Wocao, the threat actors purchased servers with Bitcoin to use during the operation.
Technique: T1583.004 Acquire Infrastructure: Server, Tactic: TA0042 Resource Development
Earth Lusca has acquired multiple servers for some of their operations, using each server for a different role.
Technique: T1583.004 Acquire Infrastructure: Server, Tactic: TA0042 Resource Development
GALLIUM has used Taiwan-based servers that appear to be exclusive to GALLIUM.
Technique: T1583.004 Acquire Infrastructure: Server, Tactic: TA0042 Resource Development
Kimsuky has purchased hosting servers with virtual currency and prepaid cards.
Technique: T1583.004 Acquire Infrastructure: Server, Tactic: TA0042 Resource Development
Mustard Tempest has acquired servers to host second-stage payloads that remain active for a period of either days, weeks, or months.
Technique: T1583.004 Acquire Infrastructure: Server, Tactic: TA0042 Resource Development
Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.
Technique: T1583.004 Acquire Infrastructure: Server, Tactic: TA0042 Resource Development
During Operation Dream Job, Lazarus Group used file hosting services like DropBox and OneDrive.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
For Operation Sharpshooter, the threat actors used Dropbox to host lure documents and their first-stage downloader.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
APT17 has created profile pages in Microsoft TechNet that were used as C2 infrastructure.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
APT28 has used newly-created Blogspot pages for credential harvesting operations.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
APT29 has registered algorithmically generated Twitter handles that are used for C2 by malware, such as HAMMERTOSS. APT29 has also used legitimate web services such as Dropbox and Constant Contact in their operations.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
APT32 has set up Dropbox, Amazon S3, and Google Drive to host malicious downloads.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
Confucius has obtained cloud storage service accounts to host stolen data.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
Earth Lusca has established GitHub accounts to host their malware.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
FIN7 has set up Amazon S3 buckets to host trojanized digital products.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
HAFNIUM has acquired web services for use in C2 and exfiltration.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
IndigoZebra created Dropbox accounts for their operations.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
Kimsuky has hosted content used for targeting efforts via web services such as Blogspot.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
Lazarus Group has hosted malicious downloads on Github.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
LazyScripter has established GitHub accounts to host its toolsets.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
Magic Hound has acquired Amazon S3 buckets to use in C2.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
MuddyWater has used file sharing services including OneHub, Sync, and TeraBox to distribute tools.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
POLONIUM has created and used legitimate Microsoft OneDrive accounts for their operations.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
TA2541 has hosted malicious files on various platforms including Google Drive, OneDrive, Discord, PasteText, ShareText, and GitHub.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
Turla has created web accounts including Dropbox and GitHub for C2 and document exfiltration.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
ZIRCONIUM has used GitHub to host malware linked in spearphishing e-mails.
Technique: T1583.006 Acquire Infrastructure: Web Services, Tactic: TA0042 Resource Development
Mustard Tempest has posted false advertisements including for software packages and browser updates in order to distribute malware.
Technique: T1583.008 Acquire Infrastructure: Malvertising, Tactic: TA0042 Resource Development
During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.
Technique: T1584.001 Compromise Infrastructure: Domains, Tactic: TA0042 Resource Development
For C0021, the threat actors used legitimate but compromised domains to host malicious payloads.
Technique: T1584.001 Compromise Infrastructure: Domains, Tactic: TA0042 Resource Development
For Operation Dream Job, Lazarus Group compromised domains in Italy and other countries for their C2 infrastructure.
Technique: T1584.001 Compromise Infrastructure: Domains, Tactic: TA0042 Resource Development
For the SolarWinds Compromise, APT29 compromised domains to use for C2.
Technique: T1584.001 Compromise Infrastructure: Domains, Tactic: TA0042 Resource Development
APT1 hijacked FQDNs associated with legitimate websites hosted by hop points.
Technique: T1584.001 Compromise Infrastructure: Domains, Tactic: TA0042 Resource Development
Kimsuky has compromised legitimate sites and used them to distribute malware.
Technique: T1584.001 Compromise Infrastructure: Domains, Tactic: TA0042 Resource Development
Magic Hound has used compromised domains to host links targeted to specific phishing victims.
Technique: T1584.001 Compromise Infrastructure: Domains, Tactic: TA0042 Resource Development
Mustard Tempest operates a global network of compromised websites that redirect into a traffic distribution system (TDS) to select victims for a fake browser update page.
Technique: T1584.001 Compromise Infrastructure: Domains, Tactic: TA0042 Resource Development
SideCopy has compromised domains for some of their infrastructure, including for C2 and staging malware.
Technique: T1584.001 Compromise Infrastructure: Domains, Tactic: TA0042 Resource Development
Transparent Tribe has compromised domains for use in targeted malicious campaigns.
Technique: T1584.001 Compromise Infrastructure: Domains, Tactic: TA0042 Resource Development
LAPSUS$ has reconfigured a victim's DNS records to actor-controlled domains and websites.
Technique: T1584.002 Compromise Infrastructure: DNS Server, Tactic: TA0042 Resource Development
Turla has used the VPS infrastructure of compromised Iranian threat actors.
Technique: T1584.003 Compromise Infrastructure: Virtual Private Server, Tactic: TA0042 Resource Development
During Night Dragon, threat actors compromised web servers to use for C2.
Technique: T1584.004 Compromise Infrastructure: Server, Tactic: TA0042 Resource Development
For Operation Dream Job, Lazarus Group compromised servers to host their malicious tools.
Technique: T1584.004 Compromise Infrastructure: Server, Tactic: TA0042 Resource Development
For Operation Sharpshooter, the threat actors compromised a server they used as part of the campaign's infrastructure.
Technique: T1584.004 Compromise Infrastructure: Server, Tactic: TA0042 Resource Development
APT16 has compromised otherwise legitimate sites as staging servers for second-stage payloads.
Technique: T1584.004 Compromise Infrastructure: Server, Tactic: TA0042 Resource Development
Dragonfly has compromised legitimate websites to host C2 and malware modules.
Technique: T1584.004 Compromise Infrastructure: Server, Tactic: TA0042 Resource Development
Earth Lusca has used compromised web servers as part of their operational infrastructure.
Technique: T1584.004 Compromise Infrastructure: Server, Tactic: TA0042 Resource Development
Indrik Spider has served fake updates via legitimate websites that have been compromised.
Technique: T1584.004 Compromise Infrastructure: Server, Tactic: TA0042 Resource Development
Lazarus Group has compromised servers to stage malicious tools.
Technique: T1584.004 Compromise Infrastructure: Server, Tactic: TA0042 Resource Development
Sandworm Team compromised legitimate Linux servers running the EXIM mail transfer agent for use in subsequent campaigns.
Technique: T1584.004 Compromise Infrastructure: Server, Tactic: TA0042 Resource Development
Turla has used compromised servers as infrastructure.
Technique: T1584.004 Compromise Infrastructure: Server, Tactic: TA0042 Resource Development
Volt Typhoon has used compromised PRTG servers from other organizations for C2.
Technique: T1584.004 Compromise Infrastructure: Server, Tactic: TA0042 Resource Development
Axiom has used large groups of compromised machines for use as proxy nodes.
Technique: T1584.005 Compromise Infrastructure: Botnet, Tactic: TA0042 Resource Development
Sandworm Team has used a large-scale botnet to target Small Office/Home Office (SOHO) network devices.
Technique: T1584.005 Compromise Infrastructure: Botnet, Tactic: TA0042 Resource Development
Earth Lusca has compromised Google Drive repositories.
Technique: T1584.006 Compromise Infrastructure: Web Services, Tactic: TA0042 Resource Development
Turla has frequently used compromised WordPress sites for C2 infrastructure.
Technique: T1584.006 Compromise Infrastructure: Web Services, Tactic: TA0042 Resource Development
During Cutting Edge, threat actors used compromised and out-of-support Cyberoam VPN appliances for C2.
Technique: T1584.008 Compromise Infrastructure: Network Devices, Tactic: TA0042 Resource Development
APT28 compromised Ubiquiti network devices to act as collection devices for credentials compromised via phishing webpages.
Technique: T1584.008 Compromise Infrastructure: Network Devices, Tactic: TA0042 Resource Development
Volt Typhoon has compromised small office and home office (SOHO) network edge devices, many of which were located in the same geographic area as the victim, to proxy network traffic.
Technique: T1584.008 Compromise Infrastructure: Network Devices, Tactic: TA0042 Resource Development
APT17 has created and cultivated profile pages in Microsoft TechNet. To make profile pages appear more legitimate, APT17 has created biographical sections and posted in forum threads.
Technique: T1585 Establish Accounts, Tactic: TA0042 Resource Development
Fox Kitten has created KeyBase accounts to communicate with ransomware victims.
Technique: T1585 Establish Accounts, Tactic: TA0042 Resource Development
For Operation Dream Job, Lazarus Group created fake LinkedIn accounts for their targeting efforts.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
For Operation Ghost, APT29 registered Twitter accounts to host C2 nodes.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
APT32 has set up Facebook pages in tandem with fake websites.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
CURIUM has established a network of fictitious social media accounts, including on Facebook and LinkedIn, to establish relationships with victims, often posing as an attractive woman.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
Cleaver has created fake LinkedIn profiles that included profile photos, details, and connections.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
EXOTIC LILY has established social media profiles to mimic employees of targeted companies.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
Fox Kitten has used a Twitter account to communicate with ransomware victims.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
Lazarus Group has created new Twitter accounts to conduct social engineering against potential victims.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
Leviathan has created new social media accounts for targeting efforts.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.
Technique: T1585.001 Establish Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
For FunnyDream, the threat actors likely established an identified email account to register a variety of domains that were used during the campaign.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
During Operation Dream Job, Lazarus Group created fake email accounts to correspond with fake LinkedIn personas; Lazarus Group also established email accounts to match those of the victim as part of their BEC attempt.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
For Operation Dust Storm, the threat actors established email addresses to register domains for their operations.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
During Operation Honeybee, attackers created email addresses to register for a free account for a control server used for the implants.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
For Operation Wocao, the threat actors registered email accounts to use during the campaign.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
APT1 has created email accounts for later use in social engineering, phishing, and when registering domains.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
EXOTIC LILY has created e-mail accounts to spoof targeted organizations.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
HEXANE has established email accounts for use in domain registration including for ProtonMail addresses.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
Indrik Spider has created email accounts to communicate with their ransomware victims, to include providing payment and decryption details.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
Kimsuky has created email accounts for phishing operations.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
Lazarus Group has created new email accounts for spearphishing operations.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
Leviathan has created new email accounts for targeting efforts.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
Magic Hound has established email accounts using fake personas for spearphishing operations.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
Mustang Panda has leveraged the legitimate email marketing service SMTP2Go for phishing campaigns.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
Silent Librarian has established e-mail accounts to receive e-mails forwarded from compromised accounts.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
Wizard Spider has leveraged ProtonMail email addresses in ransom notes when delivering Ryuk ransomware.
Technique: T1585.002 Establish Accounts: Email Accounts, Tactic: TA0042 Resource Development
Leviathan has compromised social media accounts to conduct social engineering attacks.
Technique: T1586.001 Compromise Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
Sandworm Team creates credential capture webpages to compromise existing, legitimate social media accounts.
Technique: T1586.001 Compromise Accounts: Social Media Accounts, Tactic: TA0042 Resource Development
APT28 has used compromised email accounts to send credential phishing emails.
Technique: T1586.002 Compromise Accounts: Email Accounts, Tactic: TA0042 Resource Development
APT29 has compromised email accounts to further enable phishing campaigns and taken control of dormant accounts.
Technique: T1586.002 Compromise Accounts: Email Accounts, Tactic: TA0042 Resource Development
HEXANE has used compromised accounts to send spearphishing emails.
Technique: T1586.002 Compromise Accounts: Email Accounts, Tactic: TA0042 Resource Development
IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.
Technique: T1586.002 Compromise Accounts: Email Accounts, Tactic: TA0042 Resource Development
Kimsuky has compromised email accounts to send spearphishing e-mails.
Technique: T1586.002 Compromise Accounts: Email Accounts, Tactic: TA0042 Resource Development
LAPSUS$ has payed employees, suppliers, and business partners of target organizations for credentials.
Technique: T1586.002 Compromise Accounts: Email Accounts, Tactic: TA0042 Resource Development
Leviathan has compromised email accounts to conduct social engineering attacks.
Technique: T1586.002 Compromise Accounts: Email Accounts, Tactic: TA0042 Resource Development
Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.
Technique: T1586.002 Compromise Accounts: Email Accounts, Tactic: TA0042 Resource Development
APT29 has used residential proxies, including Azure Virtual Machines, to obfuscate their access to victim environments.
Technique: T1586.003 Compromise Accounts: Cloud Accounts, Tactic: TA0042 Resource Development
Kimsuky created and used a mailing toolkit to use in spearphishing attacks.
Technique: T1587 Develop Capabilities, Tactic: TA0042 Resource Development
For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
For Operation Ghost, APT29 used new strains of malware including FatDuke, MiniDuke, RegDuke, and PolyglotDuke.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
In the Triton Safety Instrumented System Attack, TEMP.Veles developed, prior to the attack, malware capabilities that would require access to specific and specialized hardware and software.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
APT29 has used unique malware in many of their operations.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
FIN13 has utilized custom malware to maintain persistence in a compromised environment.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
FIN7 has developed malware for use in operations, including the creation of infected removable media.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
Indrik Spider has developed malware for their operations, including ransomware such as BitPaymer and WastedLocker.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
Lazarus Group has developed custom malware for use in their operations.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
LuminousMoth has used unique malware for information theft and exfiltration.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
TeamTNT has developed custom malware such as Hildegard.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
Turla has developed its own unique malware for use in operations.
Technique: T1587.001 Develop Capabilities: Malware, Tactic: TA0042 Resource Development
During Operation Dream Job, Lazarus Group digitally signed their malware and the dbxcli utility.
Technique: T1587.002 Develop Capabilities: Code Signing Certificates, Tactic: TA0042 Resource Development
PROMETHIUM has created self-signed certificates to sign malicious installers.
Technique: T1587.002 Develop Capabilities: Code Signing Certificates, Tactic: TA0042 Resource Development
Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.
Technique: T1587.002 Develop Capabilities: Code Signing Certificates, Tactic: TA0042 Resource Development
For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered.
Technique: T1587.003 Develop Capabilities: Digital Certificates, Tactic: TA0042 Resource Development
APT29 has created self-signed digital certificates to enable mutual TLS authentication for malware.
Technique: T1587.003 Develop Capabilities: Digital Certificates, Tactic: TA0042 Resource Development
PROMETHIUM has created self-signed digital certificates for use in HTTPS C2 traffic.
Technique: T1587.003 Develop Capabilities: Digital Certificates, Tactic: TA0042 Resource Development
For C0015, the threat actors used Cobalt Strike and Conti ransomware.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
For FunnyDream, the threat actors used a new backdoor named FunnyDream.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
During Night Dragon, threat actors used Trojans from underground hacker websites.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
For Operation Spalax, the threat actors obtained malware, including Remcos, njRAT, and AsyncRAT.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
APT1 used publicly available malware for privilege escalation.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
Andariel has used a variety of publicly-available remote access Trojans (RATs) for its operations.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
Aquatic Panda has acquired and used njRAT in its operations.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
BackdoorDiplomacy has obtained and used leaked malware, including DoublePulsar, EternalBlue, EternalRocks, and EternalSynergy, in its operations.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
Earth Lusca has acquired and used a variety of malware, including Cobalt Strike.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
LAPSUS$ acquired and used the Redline password stealer in their operations.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
LazyScripter has used a variety of open-source remote access Trojans for its operations.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
LuminousMoth has obtained and used malware such as Cobalt Strike.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
Metador has used unique malware in their operations, including metaMain and Mafalda.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
TA2541 has used multiple strains of malware available for purchase on criminal forums or in open-source repositories.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
TA505 has used malware such as Azorult and Cobalt Strike in their operations.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
Turla has used malware obtained after compromising other threat actors, such as OilRig.
Technique: T1588.001 Obtain Capabilities: Malware, Tactic: TA0042 Resource Development
For C0010, UNC3890 actors obtained multiple publicly-available tools, including METASPLOIT, UNICORN, and NorthStar C2.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
For C0015, the threat actors obtained a variety of tools, including AdFind,  AnyDesk, and Process Hacker.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
For C0017, APT41 obtained publicly available tools such as YSoSerial.NET, ConfuserEx, and BadPotato.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
For C0018, the threat actors acquired a variety of open source tools, including Mimikatz, Sliver, SoftPerfect Network Scanner, AnyDesk, and PDQ Deploy.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
For C0021, the threat actors used Cobalt Strike configured with a modified variation of the publicly available Pandora Malleable C2 Profile.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
During C0027, Scattered Spider obtained and used multiple tools including the LINpeas privilege escalation utility, aws_consoler, rsocx reverse proxy, Level RMM tool, and RustScan port scanner.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
During the C0032 campaign, TEMP.Veles obtained and used tools such as Mimikatz and PsExec.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
During CostaRicto, the threat actors obtained open source tools to use in their operations.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
During Cutting Edge, threat actors leveraged tools including Interactsh to identify vulnerable targets, PySoxy to simultaneously dispatch traffic between multiple endpoints, BusyBox to enable post exploitation activities, and Kubo Injector to inject shared objects into process memory.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
For Frankenstein, the threat actors obtained and used Empire.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
For FunnyDream, the threat actors used a modified version of the open source PcShare remote administration tool.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
During Night Dragon, threat actors obtained and used tools such as gsecdump.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
For Operation Dream Job, Lazarus Group obtained tools such as Wake-On-Lan, Responder, ChromePass, and dbxcli.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
For Operation Spalax, the threat actors obtained packers such as CyaX.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
For Operation Wocao, the threat actors obtained a variety of open source tools, including JexBoss, KeeThief, and BloodHound.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
In the Triton Safety Instrumented System Attack, TEMP.Veles used tools such as Mimikatz and other open-source software.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
APT-C-36 obtained and used a modified variant of Imminent Monitor.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
APT1 has used various open-source tools for privilege escalation purposes.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
APT19 has obtained and used publicly-available tools like Empire.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
APT28 has obtained and used open-source tools like Koadic, Mimikatz, and Responder.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
APT32 has obtained and used tools such as Mimikatz and Cobalt Strike, and a variety of other open-source tools from GitHub.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
APT33 has obtained and leveraged publicly-available tools for early intrusion activities.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
APT38 has obtained and used open-source tools such as Mimikatz.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
APT39 has modified and used customized versions of publicly-available tools like PLINK and Mimikatz.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
APT41 has obtained and used tools such as Mimikatz, pwdump, PowerSploit, and Windows Credential Editor.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Aoqin Dragon obtained the Heyoka open source exfiltration tool and subsequently modified it for their operations.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Aquatic Panda has acquired and used Cobalt Strike in its operations.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
BITTER has obtained tools such as PuTTY for use in their operations.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
BRONZE BUTLER has obtained and used open-source tools such as Mimikatz, gsecdump, and Windows Credential Editor.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
BackdoorDiplomacy has obtained a variety of open-source reconnaissance and red team tools for discovery and lateral movement.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
BlackTech has obtained and used tools such as Putty, SNScan, and PsExec for its operations.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Blue Mockingbird has obtained and used tools such as Mimikatz.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Carbanak has obtained and used open-source tools such as PsExec and Mimikatz.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Chimera has obtained and used tools such as BloodHound, Cobalt Strike, Mimikatz, and PsExec.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Cinnamon Tempest has used open-source tools including customized versions of the Iox proxy tool, NPS tunneling tool, Meterpreter, and a keylogger that uploads data to Alibaba cloud storage.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Cleaver has obtained and used open-source tools such as PsExec, Windows Credential Editor, and Mimikatz.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Cobalt Group has obtained and used a variety of tools including Mimikatz, PsExec, Cobalt Strike, and SDelete.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
CopyKittens has used Metasploit, Empire, and AirVPN for post-exploitation activities.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
DarkHydrus has obtained and used tools such as Mimikatz, Empire, and Cobalt Strike.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
DarkVishnya has obtained and used tools such as Impacket, Winexe, and PsExec.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Dragonfly has obtained and used tools such as Mimikatz, CrackMapExec, and PsExec.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Earth Lusca has acquired and used a variety of open source tools.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Ember Bear has obtained and used open source scripts from GitHub.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
FIN10 has relied on publicly-available software to gain footholds and establish persistence in victim environments.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
FIN13 has utilized publicly available tools such as Mimikatz, Impacket, PWdump7, ProcDump, Nmap, and Incognito V2 for targeting efforts.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
FIN5 has obtained and used a customized version of PsExec, as well as use other tools such as pwdump, SDelete, and Windows Credential Editor.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
FIN6 has obtained and used tools such as Mimikatz, Cobalt Strike, and AdFind.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
FIN7 has utilized a variety of tools such as Cobalt Strike, PowerSploit, and the remote management tool, Atera for targeting efforts.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
FIN8 has used open-source tools such as Impacket for targeting efforts.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Inception has obtained and used open-source tools such as LaZagne.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Ke3chang has obtained and used tools such as Mimikatz.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
LAPSUS$ has obtained tools such as RVTools and AD Explorer for their operations.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Lazarus Group has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
LuminousMoth has obtained an ARP spoofing tool from GitHub.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Magic Hound has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Metador has used Microsoft's Console Debugger in some of their operations.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Moses Staff has used the commercial tool DiskCryptor.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
MuddyWater has made use of legitimate tools ConnectWise and Remote Utilities to gain access to target environment.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
POLONIUM has obtained and used tools such as AirVPN and plink in their operations.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Patchwork has obtained and used open-source tools such as QuasarRAT.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
PittyTiger has obtained and used tools such as Mimikatz and gsecdump.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Sandworm Team has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Silent Librarian has obtained free and publicly available tools including SingleFile and HTTrack to copy login pages of targeted organizations.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
TA2541 has used commodity remote access tools.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
TA505 has used a variety of tools in their operations, including AdFind, BloodHound, Mimikatz, and PowerSploit.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Thrip has obtained and used tools such as Mimikatz and PsExec.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Turla has obtained and customized publicly-available tools like Mimikatz.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Volt Typhoon has used customized versions of open-source tools for C2.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
WIRTE has obtained and used Empire for post-exploitation activities.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development
Whitefly has obtained and used tools such as Mimikatz.
Technique: T1588.002 Obtain Capabilities: Tool, Tactic: TA0042 Resource Development