sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Patchwork has signed malware with self-signed certificates from fictitious and spoofed legitimate software companies.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Patchwork has created self-signed certificates from fictitious and spoofed legitimate software companies that were later used to sign malware.
MITRE ATT&CK technique: T1587.002: Develop Capabilities- Code Signing Certificates
Patchwork has obfuscated a script with Crypto Obfuscator.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Patchwork dumped the login data database from \AppData\Local\Google\Chrome\User Data\Default\Login Data.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
A Patchwork .dll that contains BADNEWS is loaded and executed using DLL side-loading.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Patchwork collected and exfiltrated files from the infected system.
MITRE ATT&CK technique: T1005: Data from Local System
Patchwork hides base64-encoded and encrypted C2 server locations in comments on legitimate websites.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
Patchwork has used watering holes to deliver files with exploits to initial victims.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Patchwork leveraged the DDE protocol to deliver their malware.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
Patchwork uses malicious documents to deliver remote execution exploits as part of. The group has previously exploited CVE-2017-8570, CVE-2012-1856, CVE-2014-4114, CVE-2017-0199, CVE-2017-11882, and CVE-2015-1641.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Patchwork removed certain files and replaced them so they could not be retrieved.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Patchwork apparently altered NDiskMonitor samples by adding four bytes of random letters in a likely attempt to change the file hashes.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
Patchwork payloads download additional files from the C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Patchwork copied all targeted files to a directory called index that was eventually uploaded to the C&C server.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Patchwork embedded a malicious macro in a Word document and lured the victim to click on an icon to execute the malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Patchwork has used spearphishing with links to try to get users to click, download and open malicious files.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Patchwork installed its payload in the startup programs folder as "Baidu Software Update." The group also adds its second stage payload to the startup programs as “Net Monitor." They have also dropped QuasarRAT binaries as files named microsoft_network.exe and crome.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
A Patchwork payload deletes Resiliency Registry keys created by Microsoft Office applications in an apparent effort to trick users into thinking there were no issues during application runs.
MITRE ATT&CK technique: T1112: Modify Registry
Patchwork used PowerSploit to download payloads, run a reverse shell, and execute malware on the victim's machine.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
A Patchwork payload uses process hollowing to hide the UAC bypass vulnerability exploitation inside svchost.exe.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Patchwork has added the path of its second-stage malware to the startup folder to achieve persistence. One of its file stealers has also persisted by adding a Registry Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Patchwork attempted to use RDP to move laterally.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
A Patchwork file stealer can run a TaskScheduler DLL to add persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Patchwork scanned the “Program Files” directories for a directory with the string “Total Security” .
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
A Patchwork payload was packed with UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Patchwork has used spearphishing with an attachment to deliver files with exploits to initial victims.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Patchwork has used spearphishing with links to deliver files with exploits to initial victims.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Patchwork has used embedded image tags with unique, per-recipient tracking links in their emails for the purpose of identifying which recipients opened messages.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
Patchwork used Base64 to encode C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Patchwork collected the victim computer name, OS version, and architecture type and sent the information to its C2 server. Patchwork also enumerated all available drives on the victim's machine.
MITRE ATT&CK technique: T1082: System Information Discovery
Patchwork collected the victim username and whether it was running as admin, then sent the information to its C2 server.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Patchwork has obtained and used open-source tools such as QuasarRAT.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Patchwork used Visual Basic Scripts on victim machines.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Patchwork ran a reverse shell with Meterpreter. Patchwork used JavaScript code and .SCT files on victim machines.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
PittyTiger has obtained and used tools such as Mimikatz and gsecdump.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
PittyTiger attempts to obtain legitimate credentials during operations.
MITRE ATT&CK technique: T1078: Valid Accounts
Play has used WinRAR to compress files prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Play has used tools to remove log files on targeted systems.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Play has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Play has split victims' files into chunks for exfiltration.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
Play has used tools including GMER, IOBit, and PowerTool to disable antivirus software.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Play has used valid domain accounts for access.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Play has used WinSCP to exfiltrate data to actor-controlled accounts.
MITRE ATT&CK technique: T1048: Exfiltration Over Alternative Protocol
Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 in Microsoft Exchange.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Play has used Remote Desktop Protocol and Virtual Private Networks for initial access.
MITRE ATT&CK technique: T1133: External Remote Services
Play has used tools including Wevtutil to remove malicious files from compromised hosts.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Play has used the Grixba information stealer to list security files and processes.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Play demands ransom payments from victims to unencrypt filesystems and to not publish sensitive data exfiltrated from victim networks.
MITRE ATT&CK technique: T1657: Financial Theft
Play has used Cobalt Strike to download files to compromised machines.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Play has used Mimikatz and the Windows Task Manager to dump LSASS process memory.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Play has used valid local accounts to gain initial access.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
Play developed and employ Playcrypt ransomware.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Play has used Base64-encoded PowerShell scripts to disable Microsoft Defender.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Play has used the information stealer Grixba to check for a list of security processes.
MITRE ATT&CK technique: T1057: Process Discovery
Play has used tools such as AdFind, Nltest, and BloodHound to enumerate shares and hostnames on compromised networks.
MITRE ATT&CK technique: T1018: Remote System Discovery
Play has used Cobalt Strike to move laterally via SMB.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Play has used the information-stealing tool Grixba to scan for anti-virus software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Play has leveraged tools to enumerate system information.
MITRE ATT&CK technique: T1082: System Information Discovery
Play has used the information-stealing tool Grixba to enumerate network information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Play has used multiple tools for discovery and defense evasion purposes on compromised hosts.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Play has used valid VPN accounts to achieve initial access.
MITRE ATT&CK technique: T1078: Valid Accounts
Play has used a batch script to remove indicators of its presence on compromised hosts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Poseidon Group searches for administrator accounts on both the local victim machine and the network.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Poseidon Group searches for administrator accounts on both the local victim machine and the network.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Poseidon Group tools attempt to spoof anti-virus processes as a means of self-defense.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Poseidon Group conducts credential dumping on victims, with a focus on obtaining credentials belonging to domain and database servers.
MITRE ATT&CK technique: T1003: OS Credential Dumping
The Poseidon Group's Information Gathering Tool includes PowerShell components.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
After compromising a victim, Poseidon Group lists all running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Poseidon Group obtains and saves information about victim network interfaces and addresses.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
After compromising a victim, Poseidon Group discovers all running services.
MITRE ATT&CK technique: T1007: System Service Discovery
Malware used by Putter Panda attempts to terminate processes corresponding to two components of Sophos Anti-Virus .
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
An executable dropped onto victims by Putter Panda aims to inject the specified DLL into a process that would normally be accessing the network, including Outlook Express , Outlook , Internet Explorer , and Firefox .
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Droppers used by Putter Panda use RC4 or a 16-byte XOR key consisting of the bytes 0xA0 – 0xAF to obfuscate payloads.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
A dropper used by Putter Panda installs itself into the ASEP Registry key HKCU\Software\Microsoft\Windows\CurrentVersion\Run with a value named McUpdate.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
RTM has used search order hijacking to force TeamViewer to load a malicious DLL.
MITRE ATT&CK technique: T1574.001: Hijack Execution Flow- DLL Search Order Hijacking
RTM has used an RSS feed on Livejournal to update a list of encrypted C2 server names.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
RTM has distributed its malware via the RIG and SUNDOWN exploit kits, as well as online advertising network Yandex.Direct.
MITRE ATT&CK technique: T1189: Drive-by Compromise
RTM has attempted to lure victims into opening e-mail attachments to execute malicious code.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
RTM has used Registry run keys to establish persistence for the RTM Trojan and other tools, such as a modified version of TeamViewer remote desktop software.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
RTM has used a modified version of TeamViewer and Remote Utilities for remote access.
MITRE ATT&CK technique: T1219: Remote Access Software
RTM has used spearphishing attachments to distribute its malware.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Rancor has downloaded additional malware, including by using certutil.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Rancor attempted to get users to click on an embedded macro within a Microsoft Office Excel document to launch their malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Rancor has used msiexec to download and execute malicious installer files over HTTP.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Rancor launched a scheduled task to gain persistence using the schtasks /create /sc command.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Rancor has attached a malicious document to an email to gain initial access.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Rancor has used VBS scripts as well as embedded macros for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Rancor has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Rancor has used cmd.exe to execute commmands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Rancor has complied VBScript-generated MOF files into WMI event subscriptions for persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
RedCurl has downloaded 7-Zip to decompress password protected archives.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
RedCurl has used HTTPS for C2 communication.
MITRE ATT&CK technique: T1573.002: Encrypted Channel- Asymmetric Cryptography
RedCurl has used batch scripts to collect data.
MITRE ATT&CK technique: T1119: Automated Collection
RedCurl has used batch scripts to exfiltrate data.
MITRE ATT&CK technique: T1020: Automated Exfiltration
RedCurl used LaZagne to obtain passwords in files.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
RedCurl used LaZagne to obtain passwords from web browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
RedCurl used LaZagne to obtain passwords in the Registry.
MITRE ATT&CK technique: T1552.002: Unsecured Credentials- Credentials in Registry
RedCurl has collected data from the local disk of compromised hosts.
MITRE ATT&CK technique: T1005: Data from Local System
RedCurl has collected data about network drives.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
RedCurl has collected information about domain accounts using SysInternal’s AdExplorer functionality .
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
RedCurl has collected information about email accounts.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
RedCurl has deleted files after execution.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
RedCurl has searched for and collected files on local and network drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
RedCurl prompts the user for credentials through a Microsoft Outlook pop-up.
MITRE ATT&CK technique: T1056.002: Input Capture- GUI Input Capture
RedCurl added the “hidden” file attribute to original files, manipulating victims to click on malicious LNK files.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
RedCurl has used pcalua.exe to obfuscate binary execution and remote connections.
MITRE ATT&CK technique: T1202: Indirect Command Execution
RedCurl used LaZagne to obtain passwords from memory.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
RedCurl has collected information about local accounts.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
RedCurl has collected emails to use in future phishing campaigns.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
RedCurl has used malicious files to infect the victim machines.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
RedCurl has used malicious links to infect the victim machines.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
RedCurl has created its own tools to use during operations.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
RedCurl mimicked legitimate file names and scheduled tasks, e.g. ` MicrosoftCurrentupdatesCheck` and `MdMMaintenenceTask` to mask malicious files and scheduled tasks.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
RedCurl has used netstat to check if port 4119 is open.
MITRE ATT&CK technique: T1046: Network Service Discovery
RedCurl has used malware with string encryption. RedCurl has also encrypted data and has encoded PowerShell commands using Base64. RedCurl has used `PyArmor` to obfuscate code execution of LaZagne. Additionally, RedCurl has obfuscated downloaded files by renaming them as commonly used tools and has used `echo`, instead of file names themselves, to execute files.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
RedCurl has used PowerShell to execute commands and to download malware.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
RedCurl has used a Python script to establish outbound communication and to execute commands using SMB port 445.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
RedCurl has established persistence by creating entries in `HKCU\Software\Microsoft\Windows\CurrentVersion\Run`.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
RedCurl has used rundll32.exe to execute malicious files.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
RedCurl has created scheduled tasks for persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
RedCurl has used phishing emails with malicious files to gain initial access.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
RedCurl has used phishing emails with malicious links to gain initial access.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
RedCurl has used AES-128 CBC to encrypt C2 communications.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
RedCurl has collected information about the target system, such as system information and list of network connections.
MITRE ATT&CK technique: T1082: System Information Discovery
RedCurl has placed modified LNK files on network drives for lateral movement.
MITRE ATT&CK technique: T1080: Taint Shared Content
RedCurl has used cloud storage to exfiltrate data, in particular the megatools utilities were used to exfiltrate data to Mega, a file storage service.
MITRE ATT&CK technique: T1537: Transfer Data to Cloud Account
RedCurl has gained access to a contractor to pivot to the victim’s infrastructure.
MITRE ATT&CK technique: T1199: Trusted Relationship
RedCurl has used VBScript to run malicious files.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
RedCurl has used HTTP, HTTPS and Webdav protocls for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
RedCurl has used web services to download malicious files.
MITRE ATT&CK technique: T1102: Web Service
RedCurl has used the Windows Command Prompt to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Rocke issued wget requests from infected systems to the C2.
MITRE ATT&CK technique: T1071: Application Layer Protocol
Rocke has installed an "init.d" startup script to maintain persistence.
MITRE ATT&CK technique: T1037: Boot or Logon Initialization Scripts
Rocke has cleared log files within the /var/log/ folder.
MITRE ATT&CK technique: T1070.002: Indicator Removal- Clear Linux or Mac System Logs
Rocke has compiled malware, delivered to victims as .c files, with the GNU Compiler Collection .
MITRE ATT&CK technique: T1027.004: Obfuscated Files or Information- Compile After Delivery
Rocke has distributed cryptomining malware.
MITRE ATT&CK technique: T1496.001: Resource Hijacking- Compute Hijacking
Rocke installed a cron job that downloaded and executed files from the C2.
MITRE ATT&CK technique: T1053.003: Scheduled Task/Job- Cron
Rocke has used Pastebin to check the version of beaconing malware and redirect to another Pastebin hosting updated malware.
MITRE ATT&CK technique: T1102.001: Web Service- Dead Drop Resolver
Rocke has extracted tar.gz files after downloading them from a C2 server.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Rocke used scripts which killed processes and added firewall rules to block traffic related to other cryptominers.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Rocke used scripts which detected and uninstalled antivirus software.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.
MITRE ATT&CK technique: T1574.006: Hijack Execution Flow- Dynamic Linker Hijacking
Rocke exploited Apache Struts, Oracle WebLogic , and Adobe ColdFusion vulnerabilities to deliver malware.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Rocke has deleted files on infected machines.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Rocke downloaded a file "libprocesshider", which could hide files on the target system.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Rocke used malware to download additional malicious files to the target system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Rocke has changed file permissions of files so they could not be modified.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
Rocke has used shell scripts which download mining executables and saves them with the filename "java".
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Rocke conducted scanning for exposed TCP port 7001 as well as SSH and Redis servers.
MITRE ATT&CK technique: T1046: Network Service Discovery
Rocke's miner connects to a C2 server using port 51640.
MITRE ATT&CK technique: T1571: Non-Standard Port
Rocke has modified UPX headers after packing files to break unpackers.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Rocke's miner, "TermsHost.exe", evaded defenses by injecting itself into Windows processes, including Notepad.exe.
MITRE ATT&CK technique: T1055.002: Process Injection- Portable Executable Injection
Rocke has used SSH private keys on the infected machine to spread its coinminer throughout a network.
MITRE ATT&CK technique: T1552.004: Unsecured Credentials- Private Keys
Rocke can detect a running process's PID on the infected machine.
MITRE ATT&CK technique: T1057: Process Discovery
Rocke has used Python-based malware to install and spread their coinminer.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Rocke has looked for IP addresses in the known_hosts file on the infected system and attempted to SSH into them.
MITRE ATT&CK technique: T1018: Remote System Discovery
Rocke has modified /etc/ld.so.preload to hook libc functions in order to hide the installed dropper and mining software in process lists.
MITRE ATT&CK technique: T1014: Rootkit
Rocke has spread its coinminer via SSH.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
Rocke used scripts which detected and uninstalled antivirus software.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Rocke's miner has created UPX-packed files in the Windows Start Menu Folder.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Rocke has used uname -m to collect the name and information about the infected system's kernel.
MITRE ATT&CK technique: T1082: System Information Discovery
Rocke has installed a systemd service script to maintain persistence.
MITRE ATT&CK technique: T1543.002: Create or Modify System Process- Systemd Service
Rocke has changed the time stamp of certain files.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Rocke used shell scripts to run commands which would obtain persistence and execute the cryptocurrency mining malware.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
Rocke has executed wget and curl commands to Pastebin over the HTTPS protocol.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Rocke has used Pastebin, Gitee, and GitLab for Command and Control.
MITRE ATT&CK technique: T1102: Web Service
Saint Bear has used an initial loader malware featuring a legitimate code signing certificate associated with "Electrum Technologies GmbH."
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Saint Bear has used the Windows Script Host to execute intermediate files written to victim machines.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Saint Bear will modify registry entries and scheduled task objects associated with Windows Defender to disable its functionality.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Saint Bear gathered victim email information in advance of phishing operations for targeted attacks.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
Saint Bear initial payloads included encoded follow-on payloads located in the resources file of the first-stage loader.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Saint Bear has leveraged vulnerabilities in client applications such as CVE-2017-11882 in Microsoft Office to enable code execution in victim environments.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Saint Bear has impersonated government and related entities in both phishing activity and developing web sites with malicious links that mimic legitimate resources.
MITRE ATT&CK technique: T1656: Impersonation
Saint Bear has delivered malicious Microsoft Office files containing an embedded JavaScript object that would, on execution, download and execute OutSteel and Saint Bot.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Saint Bear relies on user interaction and execution of malicious attachments and similar for initial execution on victim systems.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Saint Bear has, in addition to email-based phishing attachments, used malicious websites masquerading as legitimate entities to host links to malicious files for user execution.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Saint Bear will leverage malicious Windows batch scripts to modify registry values associated with Windows Defender functionality.
MITRE ATT&CK technique: T1112: Modify Registry
Saint Bear relies extensively on PowerShell execution from malicious attachments and related content to retrieve and execute follow-on payloads.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Saint Bear clones .NET assemblies from other .NET binaries as well as cloning code signing certificates from other software to obfuscate the initial loader payload.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Saint Bear uses a variety of file formats, such as Microsoft Office documents, ZIP archives, PDF documents, and other items as phishing attachments for initial access.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Saint Bear has used the Discord content delivery network for hosting malicious content referenced in links and emails.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
Saint Bear contains several anti-analysis and anti-virtualization checks.
MITRE ATT&CK technique: T1497: Virtualization/Sandbox Evasion
Saint Bear has leveraged the Discord content delivery network to host malicious content for retrieval during initial access operations.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
Saint Bear initial loaders will also drop a malicious Windows batch file, available via open source GitHub repositories, that disables Microsoft Defender functionality.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Sandworm Team used various third-party email campaign management services to deliver phishing emails.
MITRE ATT&CK technique: T1583: Acquire Infrastructure
Sandworm Team has used the Telegram Bot API from Telegram Messenger to send and receive commands to its Python backdoor. Sandworm Team also used legitimate M.E.Doc software update check requests for sending and receiving commands and hosted malicious payloads on putdrive.com.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Sandworm Team has used a large-scale botnet to target Small Office/Home Office network devices.
MITRE ATT&CK technique: T1584.005: Compromise Infrastructure- Botnet
In preparation for its attack against the 2018 Winter Olympics, Sandworm Team conducted online research of partner organizations listed on an official PyeongChang Olympics partnership site.
MITRE ATT&CK technique: T1591.002: Gather Victim Org Information- Business Relationships
Sandworm Team has used ROT13 encoding, AES encryption and compression with the zlib library for their Python-based backdoor.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Sandworm Team has distributed NotPetya by compromising the legitimate Ukrainian accounting software M.E.Doc and replacing a legitimate software update with a malicious one.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
Sandworm Team's CredRaptor tool can collect saved passwords from various internet browsers.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Sandworm Team has used CaddyWiper, SDelete, and the BlackEnergy KillDisk component to overwrite files on victim systems. Additionally, Sandworm Team has used the JUNKMAIL tool to overwrite files with null bytes.
MITRE ATT&CK technique: T1485: Data Destruction
Sandworm Team has used Prestige ransomware to encrypt data at targeted organizations in transportation and related logistics industries in Ukraine and Poland.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Sandworm Team exfiltrates data of interest from enterprise databases using Adminer.
MITRE ATT&CK technique: T1213: Data from Information Repositories
Sandworm Team has exfiltrated internal documents, files, and other data from compromised hosts.
MITRE ATT&CK technique: T1005: Data from Local System
Sandworm Team's VBS backdoor can decode Base64-encoded data and save it to the %TEMP% folder. The group also decrypted received information using the Triple DES algorithm and decompresses it using GZip.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Sandworm Team has used the BlackEnergy KillDisk component to corrupt the infected system's master boot record.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about usernames listed in AD.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Sandworm Team has used stolen credentials to access administrative accounts within the domain.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Sandworm Team conducted technical reconnaissance of the Parliament of Georgia's official internet domain prior to its 2019 attack.
MITRE ATT&CK technique: T1590.001: Gather Victim Network Information- Domain Properties
Sandworm Team has registered domain names and created URLs that are often designed to mimic or spoof legitimate websites, such as email login pages, online file sharing and storage websites, and password reset pages, while also hosting these items on legitimate, compromised network infrastructure.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Sandworm Team used malware to enumerate email settings, including usernames and passwords, from the M.E.Doc application.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
Sandworm Team has created email accounts that mimic legitimate organizations for its spearphishing operations.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
Sandworm Team has obtained valid emails addresses while conducting research against target organizations that were subsequently used in spearphishing campaigns.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
Sandworm Team's research of potential victim organizations included the identification and collection of employee information.
MITRE ATT&CK technique: T1589.003: Gather Victim Identity Information- Employee Names
Sandworm Team temporarily disrupted service to Georgian government, non-government, and private sector websites after compromising a Georgian web hosting provider in 2019.
MITRE ATT&CK technique: T1499: Endpoint Denial of Service
Sandworm Team has sent system information to its C2 server using HTTP.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Sandworm Team exploits public-facing applications for initial access and to acquire infrastructure, such as exploitation of the EXIM mail transfer agent in Linux systems.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Sandworm Team has exploited vulnerabilities in Microsoft PowerPoint via OLE objects and Microsoft Word via crafted TIFF images .
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Sandworm Team defaced approximately 15,000 websites belonging to Georgian government, non-government, and private sector organizations in 2019.
MITRE ATT&CK technique: T1491.002: Defacement- External Defacement
Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.
MITRE ATT&CK technique: T1133: External Remote Services
Sandworm Team has used backdoors that can delete files used in an attack from an infected system.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Sandworm Team has enumerated files on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Sandworm Team has pushed additional malicious tools onto an infected system to steal user credentials, move laterally, and destroy data.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Sandworm Team uses Prestige to delete the backup catalog from the target system using: `C:\Windows\System32\wbadmin.exe delete catalog -quiet` and to delete volume shadow copies using: `C:\Windows\System32\vssadmin.exe delete shadows /all /quiet`.
MITRE ATT&CK technique: T1490: Inhibit System Recovery
Sandworm Team has used a keylogger to capture keystrokes by using the SetWindowsHookEx function.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Sandworm Team has used its plainpwd tool, a modified version of Mimikatz, and comsvcs.dll to dump Windows credentials from system memory.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Sandworm Team has used `move` to transfer files to a network share and has copied payloads--such as Prestige ransomware--to an Active Directory Domain Controller and distributed via the Default Domain Group Policy Object. Additionally, Sandworm Team has transferred an ISO file into the OT network to gain initial access.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Sandworm Team has tricked unwitting recipients into clicking on spearphishing attachments and enabling malicious macros embedded within files.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Sandworm Team has tricked unwitting recipients into clicking on malicious hyperlinks within emails crafted to resemble trustworthy senders.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Sandworm Team masqueraded malicious installers as Windows update packages to evade defense and entice users to execute binaries.
MITRE ATT&CK technique: T1036: Masquerading
Sandworm Team has avoided detection by naming a malicious binary explorer.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Sandworm Team has used `ntdsutil.exe` to back up the Active Directory database, likely for credential access.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
Sandworm Team uses Prestige to disable and restore file system redirection by using the following functions: `Wow64DisableWow64FsRedirection` and `Wow64RevertWow64FsRedirection`.
MITRE ATT&CK technique: T1106: Native API
Sandworm Team has used intercepter-NG to sniff passwords in network traffic.
MITRE ATT&CK technique: T1040: Network Sniffing
Sandworm Team has used port 6789 to accept connections on the group's SSH server.
MITRE ATT&CK technique: T1571: Non-Standard Port
Sandworm Team has used Base64 encoding within malware variants.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Sandworm Team has used PowerShell scripts to run a credential harvesting tool in memory to evade defenses.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Sandworm Team's BCS-server tool can create an internal proxy server to redirect traffic from the adversary-controlled C2 to internal servers which may not be connected to the internet, but are interconnected locally.
MITRE ATT&CK technique: T1090: Proxy
Sandworm Team has used remote administration tools or remote industrial control system client software for execution and to maliciously release electricity breakers.
MITRE ATT&CK technique: T1219: Remote Access Software
Sandworm Team has used a tool to query Active Directory using LDAP, discovering information about computers listed in AD.
MITRE ATT&CK technique: T1018: Remote System Discovery
Sandworm Team used a backdoor which could execute a supplied DLL using rundll32.exe.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Sandworm Team has copied payloads to the `ADMIN$` share of remote systems and run net use to connect to network shares.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Sandworm Team leveraged SHARPIVORY, a .NET dropper that writes embedded payload to disk and uses scheduled tasks to persist on victim machines.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Sandworm Team researched Ukraine's unique legal entity identifier , including running queries on the EDRPOU website, in preparation for the NotPetya attack. Sandworm Team has also researched third-party websites to help it craft credible spearphishing emails.
MITRE ATT&CK technique: T1593: Search Open Websites/Domains
Sandworm Team has conducted research against potential victim websites as part of its operational planning.
MITRE ATT&CK technique: T1594: Search Victim-Owned Websites
Sandworm Team has leased servers from resellers instead of leasing infrastructure directly from hosting companies to enable its operations.
MITRE ATT&CK technique: T1583.004: Acquire Infrastructure- Server
Sandworm Team compromised legitimate Linux servers running the EXIM mail transfer agent for use in subsequent campaigns.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
Sandworm Team attempts to stop the MSSQL Windows service to ensure successful encryption of locked files.
MITRE ATT&CK technique: T1489: Service Stop
Sandworm Team creates credential capture webpages to compromise existing, legitimate social media accounts.
MITRE ATT&CK technique: T1586.001: Compromise Accounts- Social Media Accounts
Sandworm Team has established social media accounts to disseminate victim internal-only documents and other sensitive data.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
Sandworm Team has researched software code to enable supply-chain operations, most notably for the 2017 NotPetya attack. Sandworm Team also collected a list of computers using specific software as part of its targeting efforts.
MITRE ATT&CK technique: T1592.002: Gather Victim Host Information- Software
Sandworm Team has used the commercially available tool RemoteExec for agentless remote code execution.
MITRE ATT&CK technique: T1072: Software Deployment Tools
Sandworm Team has delivered malicious Microsoft Office and ZIP file attachments via spearphishing emails.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Sandworm Team has crafted phishing emails containing malicious hyperlinks.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Sandworm Team has crafted spearphishing emails with hyperlinks designed to trick unwitting recipients into revealing their account credentials.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
Sandworm Team's BCS-server tool uses base64 encoding and HTML tags for the communication traffic between the C2 server.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Sandworm Team used information stealer malware to collect browser session cookies.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
Sandworm Team staged compromised versions of legitimate software installers on forums to achieve initial, untargetetd access in victim environments.
MITRE ATT&CK technique: T1195: Supply Chain Compromise
Sandworm Team used a backdoor to enumerate information about the infected system's operating system.
MITRE ATT&CK technique: T1082: System Information Discovery
Sandworm Team had gathered user, IP address, and server data related to RDP sessions on a compromised host. It has also accessed network diagram files useful for understanding how a host's network was configured.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Sandworm Team has collected the username from a compromised host.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Sandworm Team has acquired open-source tools for their operations, including Invoke-PSImage, which was used to establish an encrypted channel from a compromised host to Sandworm Team's C2 server in preparation for the 2018 Winter Olympics attack, as well as Impacket and RemoteExec, which were used in their 2022 Prestige operations. Additionally, Sandworm Team has used Empire, Cobalt Strike and PoshC2.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Sandworm Team has used dedicated network connections from one victim organization to gain unauthorized access to a separate organization. Additionally, Sandworm Team has accessed Internet service providers and telecommunication entities that provide mobile connectivity.
MITRE ATT&CK technique: T1199: Trusted Relationship
Sandworm Team staged compromised versions of legitimate software installers in forums to enable initial access to executing user.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
Sandworm Team have used previously acquired legitimate credentials prior to attacks.
MITRE ATT&CK technique: T1078: Valid Accounts
Sandworm Team has created VBScripts to run an SSH server.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
In 2017, Sandworm Team conducted technical research related to vulnerabilities associated with websites used by the Korean Sport and Olympic Committee, a Korean power company, and a Korean airport.
MITRE ATT&CK technique: T1588.006: Obtain Capabilities- Vulnerabilities
Sandworm Team has scanned network infrastructure for vulnerabilities as part of its operational planning.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
Sandworm Team's BCS-server tool connects to the designated C2 server via HTTP.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Sandworm Team has used Impacket’s WMIexec module for remote code execution and VBScript to run WMI queries.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Scarlet Mimic has used the left-to-right override character in self-extracting RAR archive spearphishing attachment file names.
MITRE ATT&CK technique: T1036.002: Masquerading- Right-to-Left Override
During C0027, Scattered Spider used IAM manipulation to gain persistence and to assume or elevate privileges. Scattered Spider has also assigned user access admin roles in order to gain Tenant Root Group management permissions in Azure.
MITRE ATT&CK technique: T1098.003: Account Manipulation- Additional Cloud Roles
Scattered Spider retrieves browser histories via infostealer malware such as Raccoon Stealer.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Scattered Spider enumerates cloud environments to identify server and backup management infrastructure, resource access, databases and storage containers.
MITRE ATT&CK technique: T1580: Cloud Infrastructure Discovery
Scattered Spider abused AWS Systems Manager Inventory to identify targets on the compromised network prior to lateral movement.
MITRE ATT&CK technique: T1538: Cloud Service Dashboard
During C0027, Scattered Spider used compromised Azure credentials for credential theft activity and lateral movement to on-premises systems. Scattered Spider has also leveraged pre-existing AWS EC2 instances for lateral movement and data collection purposes.
MITRE ATT&CK technique: T1021.007: Remote Services- Cloud Services
Scattered Spider enumerates data stored within victim code repositories, such as internal GitHub repositories.
MITRE ATT&CK technique: T1213.003: Data from Information Repositories- Code Repositories