sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
Lazarus Group malware SierraBravo-Two generates an email message via SMTP containing information about newly infected victims.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
Lazarus Group has exploited Adobe Flash vulnerability CVE-2018-4878 for execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Lazarus Group has used multiple proxies to obfuscate network traffic from victims.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
Lazarus Group malware SierraAlfa sends data to one of the hard-coded C2 servers chosen at random, and if the transmission fails, chooses a new C2 server to attempt the transmission again.
MITRE ATT&CK technique: T1008: Fallback Channels
Lazarus Group malware has deleted files in various ways, including "suicide scripts" to delete malware binaries from the victim. Lazarus Group also uses secure file deletion to delete files from the victim.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Lazarus Group has studied publicly available information about a targeted organization to tailor spearphishing efforts against specific departments and/or individuals.
MITRE ATT&CK technique: T1591: Gather Victim Org Information
Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
Lazarus Group has restored malicious KernelCallbackTable code to its original state after the process execution flow has been hijacked.
MITRE ATT&CK technique: T1070: Indicator Removal
Lazarus Group persistence mechanisms have used forfiles.exe to execute .htm files.
MITRE ATT&CK technique: T1202: Indirect Command Execution
Lazarus Group has downloaded files, malware, and tools from its C2 onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Lazarus Group replaced the background wallpaper of systems with a threatening image after rendering the system unbootable with a Disk Structure Wipe.
MITRE ATT&CK technique: T1491.001: Defacement- Internal Defacement
Lazarus Group has used a compromised router to serve as a proxy between a victim network's corporate and restricted segments.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Lazarus Group has abused the KernelCallbackTable to hijack process control flow and execute shellcode.
MITRE ATT&CK technique: T1574.013: Hijack Execution Flow- KernelCallbackTable
Lazarus Group malware KiloAlfa contains keylogging functionality.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Lazarus Group executed Responder using the command Responder file path -i IP address -rPv on a compromised host to harvest credentials and move laterally.
MITRE ATT&CK technique: T1557.001: Adversary-in-the-Middle- LLMNR/NBT-NS Poisoning and SMB Relay
Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is saved in the %TEMP% directory, then compressed, encrypted, and uploaded to a C2 server.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Lazarus Group has attempted to get users to launch a malicious Microsoft Word attachment delivered via a spearphishing email.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Lazarus Group has developed custom malware for use in their operations.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Lazarus Group has used a scheduled task named `SRCheck` to mask the execution of a malicious .dll.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Lazarus Group has renamed malicious code to disguise it as Microsoft's narrator and other legitimate files.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Lazarus Group has used mshta.exe to execute HTML pages downloaded by initial access documents.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Lazarus Group has used multi-stage malware components that inject later stages into separate processes.
MITRE ATT&CK technique: T1104: Multi-Stage Channels
Lazarus Group has used the Windows API ObtainUserAgentString to obtain the User-Agent from a compromised host to connect to a C2 server. Lazarus Group has also used various, often lesser known, functions to perform various types of Discovery and Process Injection.
MITRE ATT&CK technique: T1106: Native API
Lazarus Group has used nmap from a router VM to scan ports on systems within the restricted segment of an enterprise network.
MITRE ATT&CK technique: T1046: Network Service Discovery
Some Lazarus Group malware uses a list of ordered port numbers to choose a port for C2 traffic, creating port-protocol mismatches.
MITRE ATT&CK technique: T1571: Non-Standard Port
Lazarus Group malware attempts to connect to Windows shares for lateral movement by using a generated list of usernames, which center around permutations of the username Administrator, and weak passwords.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
Lazarus Group has used PowerShell to execute commands and malicious code.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Several Lazarus Group malware families gather a list of running processes on a victim system and send it to their C2 server. A Destover-like variant used by Lazarus Group also gathers process times.
MITRE ATT&CK technique: T1057: Process Discovery
Lazarus Group malware also uses a unique form of communication encryption known as FakeTLS that mimics TLS but uses a different encryption method, potentially evading SSL traffic inspection/decryption.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
Lazarus Group malware IndiaIndia checks Registry keys within HKCU and HKLM to determine if certain applications are present, including SecureCRT, Terminal Services, RealVNC, TightVNC, UltraVNC, Radmin, mRemote, TeamViewer, FileZilla, pcAnyware, and Remote Desktop. Another Lazarus Group malware sample checks for the presence of the following Registry key:HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-Qt.
MITRE ATT&CK technique: T1012: Query Registry
Lazarus Group has changed memory protection permissions then overwritten in memory DLL function code with shellcode, which was later executed via KernelCallbackTable hijacking. Lazarus Group has also used shellcode within macros to decrypt and manually map DLLs into memory at runtime.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Lazarus Group has maintained persistence by loading malicious code into a startup folder or by adding a Registry Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Lazarus Group malware SierraCharlie uses RDP for propagation.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Lazarus Group has renamed system utilities such as wscript.exe and mshta.exe.
MITRE ATT&CK technique: T1036.003: Masquerading- Rename System Utilities
Lazarus Group has used rundll32 to execute malicious payloads on a compromised host.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Lazarus Group malware SierraAlfa accesses the ADMIN$ share via SMB to conduct lateral movement.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Lazarus Group used SSH and the PuTTy PSCP utility to gain access to a restricted segment of a compromised network.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
Lazarus Group has used schtasks for persistence including through the periodic execution of a remote XSL script or a dropped VBS payload.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Lazarus Group has compromised servers to stage malicious tools.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
Lazarus Group has stopped the MSExchangeIS service to render Exchange contents inaccessible to users.
MITRE ATT&CK technique: T1489: Service Stop
Lazarus Group malware has maintained persistence on a system by creating a LNK shortcut in the user’s Startup folder.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Lazarus Group has created new Twitter accounts to conduct social engineering against potential victims.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
Lazarus Group has targeted victims with spearphishing emails containing malicious Microsoft Word documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Lazarus Group has sent malicious links to victims via email.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Lazarus Group has used social media platforms, including LinkedIn and Twitter, to send spearphishing messages.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
A Lazarus Group malware sample encodes data with base64.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
Several Lazarus Group malware families encrypt C2 traffic using custom code that uses XOR with an ADD operation and XOR with a SUB operation. Another Lazarus Group malware sample XORs C2 traffic. Other Lazarus Group malware uses Caracachs encryption to encrypt C2 payloads. Lazarus Group has also used AES to encrypt C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Lazarus Group lnk files used for persistence have abused the Windows Update Client to execute a malicious DLL.
MITRE ATT&CK technique: T1218: System Binary Proxy Execution
Several Lazarus Group malware families collect information on the type and version of the victim OS, as well as the victim computer name and CPU information. A Destover-like variant used by Lazarus Group also collects disk space information and sends it to its C2 server.
MITRE ATT&CK technique: T1082: System Information Discovery
Lazarus Group malware IndiaIndia obtains and sends to its C2 server information about the first network interface card’s configuration, including IP address, gateways, subnet mask, DHCP information, and whether WINS is available.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Lazarus Group has used net use to identify and establish a network connection with a remote host.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Various Lazarus Group malware enumerates logged-on users.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Lazarus Group has rebooted systems after destroying files and wiping the MBR on infected systems.
MITRE ATT&CK technique: T1529: System Shutdown/Reboot
A Destover-like implant used by Lazarus Group can obtain the current system time and send it to the C2 server.
MITRE ATT&CK technique: T1124: System Time Discovery
Several Lazarus Group malware families use timestomping, including modifying the last write timestamp of a specified Registry key to a random date, as well as copying the timestamp for legitimate .exe files to its dropped files.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Lazarus Group has obtained a variety of tools for their operations, including Responder and PuTTy PSCP.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Lazarus Group has used administrator credentials to gain access to restricted network segments.
MITRE ATT&CK technique: T1078: Valid Accounts
Lazarus Group has used VBA and embedded macros in Word documents to execute malicious code.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Lazarus Group has conducted C2 over HTTP and HTTPS.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Lazarus Group has hosted malicious downloads on Github.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
Lazarus Group malware uses cmd.exe to execute commands on a compromised host. A Destover-like variant used by Lazarus Group uses a batch file mechanism to delete its binaries from the system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Lazarus Group has used WMIC for discovery as well as to execute payloads for persistence and lateral movement.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Several Lazarus Group malware families install themselves as new services.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
LazyScripter has leveraged the BatchEncryption tool to perform advanced batch script obfuscation and encoding techniques.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
LazyScripter has leveraged dynamic DNS providers for C2 communications.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
LazyScripter has used dynamic DNS providers to create legitimate-looking subdomains for C2.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
LazyScripter had downloaded additional tools to a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
LazyScripter has used JavaScript in its attacks.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
LazyScripter has lured users to open malicious email attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
LazyScripter has relied upon users clicking on links to malicious files.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
LazyScripter has used a variety of open-source remote access Trojans for its operations.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
LazyScripter has used several different security software icons to disguise executables.
MITRE ATT&CK technique: T1036: Masquerading
LazyScripter has used `mshta.exe` to execute Koadic stagers.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
LazyScripter has used PowerShell scripts to execute malicious code.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
LazyScripter has achieved persistence via writing a PowerShell script to the autorun registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
LazyScripter has used `rundll32.exe` to execute Koadic stagers.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
LazyScripter has used spam emails weaponized with archive or document files as its initial infection vector.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
LazyScripter has used spam emails that contain a link that redirects the victim to download a malicious document.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
LazyScripter has hosted open-source remote access Trojans used in its operations in GitHub.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
LazyScripter has used VBScript to execute malicious code.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
LazyScripter has used GitHub to host its payloads to operate spam campaigns.
MITRE ATT&CK technique: T1102: Web Service
LazyScripter has established GitHub accounts to host its toolsets.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
LazyScripter has used batch files to deploy open-source and multi-stage RATs.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Leafminer used several tools for retrieving login and password information, including LaZagne.
MITRE ATT&CK technique: T1003.005: OS Credential Dumping- Cached Domain Credentials
Leafminer obfuscated scripts that were used on victim machines.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Leafminer used several tools for retrieving login and password information, including LaZagne.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Leafminer used several tools for retrieving login and password information, including LaZagne.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Leafminer used several tools for retrieving login and password information, including LaZagne.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Leafminer has infected victims using watering holes.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Leafminer infected victims using JavaScript code.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Leafminer used several tools for retrieving login and password information, including LaZagne.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
Leafminer used several tools for retrieving login and password information, including LaZagne and Mimikatz.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Leafminer used a tool called Imecab to set up a persistent remote access account on the victim machine.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Leafminer scanned network services to search for vulnerabilities in the victim system.
MITRE ATT&CK technique: T1046: Network Service Discovery
Leafminer used a tool called Total SMB BruteForcer to perform internal password spraying.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
Leafminer has used Process Doppelgänging to evade security software while deploying tools on compromised systems.
MITRE ATT&CK technique: T1055.013: Process Injection- Process Doppelgänging
Leafminer used a tool called MailSniper to search through the Exchange server mailboxes for keywords.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
Leafminer used Microsoft’s Sysinternals tools to gather detailed information about remote systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
Leafminer has obtained and used tools such as LaZagne, Mimikatz, PsExec, and MailSniper.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Leviathan has archived victim's data prior to exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
Leviathan has used BITSAdmin to download additional tools.
MITRE ATT&CK technique: T1197: BITS Jobs
Leviathan has inserted garbage characters into code, presumably to avoid anti-virus detection.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Leviathan has used stolen code signing certificates to sign malware.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Leviathan has collected compromised credentials to use for targeting efforts.
MITRE ATT&CK technique: T1589.001: Gather Victim Identity Information- Credentials
Leviathan has used a DLL known as SeDll to decrypt and execute other JavaScript backdoors.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Leviathan has established domains that impersonate legitimate entities to use for targeting efforts.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Leviathan has infected victims using watering holes.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Leviathan has utilized OLE as a method to insert malicious content inside various phishing documents.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
Leviathan has utilized techniques like reflective DLL loading to write a DLL into memory and load a shell that provides backdoor access to the victim.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Leviathan has compromised email accounts to conduct social engineering attacks.
MITRE ATT&CK technique: T1586.002: Compromise Accounts- Email Accounts
Leviathan has created new email accounts for targeting efforts.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
Leviathan has obfuscated code using base64 and gzip compression.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Leviathan has exfiltrated data over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Leviathan has used an uploader known as LUNCHMONEY that can exfiltrate files to Dropbox.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Leviathan has exploited multiple Microsoft Office and .NET vulnerabilities for execution, including CVE-2017-0199, CVE-2017-8759, and CVE-2017-11882.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Leviathan has used external remote services such as virtual private networks to gain initial access.
MITRE ATT&CK technique: T1133: External Remote Services
Leviathan has downloaded additional scripts and files from adversary-controlled servers.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Leviathan has conducted internal spearphishing within the victim's environment for lateral movement.
MITRE ATT&CK technique: T1534: Internal Spearphishing
Leviathan has used publicly available tools to dump password hashes, including ProcDump and WCE.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Leviathan has used C:\Windows\Debug and C:\Perflogs as staging directories.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Leviathan has sent spearphishing attachments attempting to get a user to click.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Leviathan has sent spearphishing email links attempting to get a user to click.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Leviathan has used multi-hop proxies to disguise the source of their malicious traffic.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Leviathan has used publicly available tools to dump password hashes, including HOMEFRY.
MITRE ATT&CK technique: T1003: OS Credential Dumping
Leviathan has received C2 instructions from user profiles created on legitimate websites such as Github and TechNet.
MITRE ATT&CK technique: T1102.003: Web Service- One-Way Communication
Leviathan has used PowerShell for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Leviathan has used protocol tunneling to further conceal C2 communications and infrastructure.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Leviathan has used regsvr32 for execution.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Leviathan has staged data remotely prior to exfiltration.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
Leviathan has targeted RDP credentials and used it to move through the victim environment.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Leviathan used ssh for internal reconnaissance.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
Leviathan has used JavaScript to create a shortcut file in the Startup folder that points to its main backdoor.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Leviathan has compromised social media accounts to conduct social engineering attacks.
MITRE ATT&CK technique: T1586.001: Compromise Accounts- Social Media Accounts
Leviathan has created new social media accounts for targeting efforts.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
Leviathan has sent spearphishing emails with malicious attachments, including .rtf, .doc, and .xls files.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Leviathan has sent spearphishing emails with links, often using a fraudulent lookalike domain and stolen branding.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Leviathan has used steganography to hide stolen data inside other files stored on Github.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
Leviathan has obtained valid accounts to gain initial access.
MITRE ATT&CK technique: T1078: Valid Accounts
Leviathan has used VBScript.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Leviathan relies on web shells for an initial foothold as well as persistence into the victim's systems.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Leviathan has used WMI for execution.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Leviathan has used WMI for persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
LuminousMoth has used ARP spoofing to redirect a compromised machine to an actor-controlled website.
MITRE ATT&CK technique: T1557.002: Adversary-in-the-Middle- ARP Cache Poisoning
LuminousMoth has manually archived stolen files from victim machines before exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
LuminousMoth has signed their malware with a valid digital signature.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
LuminousMoth has used legitimate executables such as `winword.exe` and `igfxem.exe` to side-load their malware.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
LuminousMoth has split archived files into multiple parts to bypass a 5MB limit.
MITRE ATT&CK technique: T1030: Data Transfer Size Limits
LuminousMoth has collected files and data from compromised machines.
MITRE ATT&CK technique: T1005: Data from Local System
LuminousMoth has used a valid digital certificate for some of their malware.
MITRE ATT&CK technique: T1588.004: Obtain Capabilities- Digital Certificates
LuminousMoth has redirected compromised machines to an actor-controlled webpage through HTML injection.
MITRE ATT&CK technique: T1608.004: Stage Capabilities- Drive-by Target
LuminousMoth has used malware that exfiltrates stolen data to its C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
LuminousMoth has exfiltrated data to Google Drive.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
LuminousMoth has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
LuminousMoth has used malware to store malicious binaries in hidden directories on victim's USB drives.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
LuminousMoth has downloaded additional malware and tools onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
LuminousMoth has created a link to a Dropbox file that has been used in their spear-phishing operations.
MITRE ATT&CK technique: T1608.005: Stage Capabilities- Link Target
LuminousMoth has lured victims into clicking malicious Dropbox download links delivered through spearphishing.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
LuminousMoth has used unique malware for information theft and exfiltration.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
LuminousMoth has obtained and used malware such as Cobalt Strike.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
LuminousMoth has disguised their exfiltration malware as `ZoomVideoApp.exe`.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
LuminousMoth has used malware that adds Registry keys for persistence.
MITRE ATT&CK technique: T1112: Modify Registry
LuminousMoth has used malicious DLLs that setup persistence in the Registry Key `HKCU\Software\Microsoft\Windows\Current Version\Run`.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
LuminousMoth has used malicious DLLs to spread malware to connected removable USB drives on infected machines.
MITRE ATT&CK technique: T1091: Replication Through Removable Media
LuminousMoth has created scheduled tasks to establish persistence for their tools.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
LuminousMoth has sent spearphishing emails containing a malicious Dropbox download link.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
LuminousMoth has used an unnamed post-exploitation tool to steal cookies from the Chrome browser.
MITRE ATT&CK technique: T1539: Steal Web Session Cookie
LuminousMoth has used a malicious DLL to collect the username from compromised hosts.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
LuminousMoth has obtained an ARP spoofing tool from GitHub.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
LuminousMoth has hosted malicious payloads on Dropbox.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
LuminousMoth has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Machete has distributed Machete through a fake blog website.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Machete has relied on users opening malicious attachments delivered through spearphishing to execute malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Machete has has relied on users opening malicious links delivered through spearphishing to execute malware.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Machete's Machete MSI installer has masqueraded as a legitimate Adobe Acrobat Reader installer.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Machete has used msiexec to install the Machete malware.
MITRE ATT&CK technique: T1218.007: System Binary Proxy Execution- Msiexec
Machete used multiple compiled Python scripts on the victim’s system. Machete's main backdoor Machete is also written in Python.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Machete has created scheduled tasks to maintain Machete's persistence.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Machete has delivered spearphishing emails that contain a zipped file with malicious contents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Machete has sent phishing emails that contain a link to an external server with ZIP and RAR archives.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Machete has embedded malicious macros within spearphishing attachments to download additional files.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Machete has used batch files to initiate additional downloads of malicious files.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Magic Hound granted compromised email accounts read access to the email boxes of additional targeted accounts. The group then was able to authenticate to the intended victim's OWA portal and read hundreds of email communications for information on Middle East organizations.
MITRE ATT&CK technique: T1098.002: Account Manipulation- Additional Email Delegate Permissions
Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.
MITRE ATT&CK technique: T1098.007: Account Manipulation- Additional Local or Domain Groups
Magic Hound malware has used IRC for C2.
MITRE ATT&CK technique: T1071: Application Layer Protocol
Magic Hound has used gzip to archive dumped LSASS process memory and RAR to stage and compress local folders.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Magic Hound malware can use a SOAP Web service to communicate with its C2 server.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Magic Hound has removed mailbox export requests from compromised Exchange servers.
MITRE ATT&CK technique: T1070.003: Indicator Removal- Clear Command History
Magic Hound has used base64-encoded commands.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Magic Hound gathered credentials from two victims that they then attempted to validate across 75 different websites. Magic Hound has also collected credentials from over 900 Fortinet VPN servers in the US, Europe, and Israel.
MITRE ATT&CK technique: T1589.001: Gather Victim Identity Information- Credentials
Magic Hound has used BitLocker and DiskCryptor to encrypt targeted workstations.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Magic Hound has used a web shell to exfiltrate a ZIP file containing a dump of LSASS memory on a compromised machine.
MITRE ATT&CK technique: T1005: Data from Local System
Magic Hound enabled and used the default system managed account, DefaultAccount, via `"powershell.exe" /c net user DefaultAccount /active:yes` to connect to a targeted Exchange server over RDP.
MITRE ATT&CK technique: T1078.001: Valid Accounts- Default Accounts
Magic Hound has collected location information from visitors to their phishing sites.
MITRE ATT&CK technique: T1591.001: Gather Victim Org Information- Determine Physical Locations
Magic Hound has executed scripts to disable the event log service.
MITRE ATT&CK technique: T1562.002: Impair Defenses- Disable Windows Event Logging
Magic Hound has added the following rule to a victim's Windows firewall to allow RDP traffic - `"netsh" advfirewall firewall add rule name="Terminal Server" dir=in action=allow protocol=TCP localport=3389`.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Magic Hound has disabled antivirus services on targeted systems in order to upload malicious payloads.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Magic Hound has used domain administrator accounts after dumping LSASS process memory.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Magic Hound has used a web shell to execute `nltest /trusted_domains` to identify trust relationships.
MITRE ATT&CK technique: T1482: Domain Trust Discovery
Magic Hound has registered fraudulent domains such as "mail-newyorker.com" and "news12.com.recover-session-service.site" to target specific victims with phishing attacks.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Magic Hound has used compromised domains to host links targeted to specific phishing victims.
MITRE ATT&CK technique: T1584.001: Compromise Infrastructure- Domains
Magic Hound has conducted watering-hole attacks through media and magazine websites.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Magic Hound has used Powershell to discover email accounts.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
Magic Hound has compromised personal email accounts through the use of legitimate credentials and gathered additional victim information.
MITRE ATT&CK technique: T1586.002: Compromise Accounts- Email Accounts
Magic Hound has established email accounts using fake personas for spearphishing operations.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
Magic Hound has identified high-value email accounts in academia, journalism, NGO's, foreign policy, and national security for targeting.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
Magic Hound has compromised email credentials in order to steal sensitive data.
MITRE ATT&CK technique: T1114: Email Collection
Magic Hound has used an encrypted http proxy in C2 communications.
MITRE ATT&CK technique: T1573: Encrypted Channel
Magic Hound malware has used base64-encoded files and has also encrypted embedded strings with AES.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Magic Hound has used the Telegram API `sendMessage` to relay data on compromised devices.
MITRE ATT&CK technique: T1567: Exfiltration Over Web Service
Magic Hound has exploited the Log4j utility , on-premises MS Exchange servers via "ProxyShell" , and Fortios SSL VPNs .
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Magic Hound has deleted and overwrote files to cover tracks.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Magic Hound has acquired mobile phone numbers of potential targets, possibly for mobile malware or additional phishing operations.
MITRE ATT&CK technique: T1589: Gather Victim Identity Information
Magic Hound malware has a function to determine whether the C2 server wishes to execute the newly dropped file in a hidden window.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Magic Hound has captured the IP addresses of visitors to their phishing sites.
MITRE ATT&CK technique: T1590.005: Gather Victim Network Information- IP Addresses
Magic Hound has disabled LSA protection on compromised hosts using `"reg" add HKLM\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL /t REG_DWORD /d 0 /f`.
MITRE ATT&CK technique: T1562: Impair Defenses
Magic Hound has downloaded additional code and files from servers onto victims.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Magic Hound has conducted a network call out to a specific website as part of their initial discovery activity.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
Magic Hound malware is capable of keylogging.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Magic Hound has stolen domain credentials by dumping LSASS process memory using Task Manager, comsvcs.dll, and from a Microsoft Active Directory Domain Controller using Mimikatz.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Magic Hound has copied tools within a compromised network using RDP.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Magic Hound has collected .PST archives.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
Magic Hound has attempted to lure victims into opening malicious email attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Magic Hound has attempted to lure victims into opening malicious links embedded in emails.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Magic Hound has created local accounts named `help` and `DefaultAccount` on compromised machines.
MITRE ATT&CK technique: T1036.010: Masquerading- Masquerade Account Name
Magic Hound has named a malicious script CacheTask.bat to mimic a legitimate task.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Magic Hound has used `dllhost.exe` to mask Fast Reverse Proxy and `MicrosoftOutLookUpdater.exe` for Plink.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Magic Hound has modified Registry settings for security tools.
MITRE ATT&CK technique: T1112: Modify Registry
Magic Hound has used KPortScan 3.0 to perform SMB, RDP, and LDAP scanning.
MITRE ATT&CK technique: T1046: Network Service Discovery
Magic Hound malware has communicated with its C2 server over TCP ports 4443 and 10151 using HTTP.
MITRE ATT&CK technique: T1571: Non-Standard Port
Magic Hound has used PowerShell for execution and privilege escalation.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Magic Hound malware can list running processes.
MITRE ATT&CK technique: T1057: Process Discovery
Magic Hound has used Plink to tunnel RDP over SSH.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Magic Hound has used Fast Reverse Proxy for RDP traffic.
MITRE ATT&CK technique: T1090: Proxy
Magic Hound malware has used Registry Run keys to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Magic Hound has used Remote Desktop Services to copy tools on targeted systems.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Magic Hound has exported emails from compromised Exchange servers including through use of the cmdlet `New-MailboxExportRequest.`
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
Magic Hound has used Ping for discovery on targeted networks.
MITRE ATT&CK technique: T1018: Remote System Discovery
Magic Hound has used rundll32.exe to execute MiniDump from comsvcs.dll when dumping LSASS memory.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Magic Hound has used scheduled tasks to establish persistence and execution.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Magic Hound malware can take a screenshot and upload the file to its C2 server.
MITRE ATT&CK technique: T1113: Screen Capture
Magic Hound has created fake LinkedIn and other social media accounts to contact targets and convince them--through messages and voice communications--to open malicious links.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
Magic Hound has captured the user-agent strings from visitors to their phishing sites.
MITRE ATT&CK technique: T1592.002: Gather Victim Host Information- Software
Magic Hound has sent malicious URL links through email to victims. In some cases the URLs were shortened or linked to Word documents with malicious macros that executed PowerShells scripts to download Pupy.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Magic Hound has used SMS and email messages with links designed to steal credentials or track victims.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
Magic Hound used various social media channels as well as messaging services to spearphish victims.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
Magic Hound malware has used a PowerShell command to check the victim system architecture to determine if it is an x64 machine. Other malware has obtained the OS version, UUID, and computer/host name to send to the C2 server.
MITRE ATT&CK technique: T1082: System Information Discovery
Magic Hound malware gathers the victim's local IP address, MAC address, and external IP address.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Magic Hound has used quser.exe to identify existing RDP connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Magic Hound malware has obtained the victim username and sent it to the C2 server.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Magic Hound has obtained and used tools like Havij, sqlmap, Metasploit, Mimikatz, and Plink.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Magic Hound malware has used VBS scripts for execution.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Magic Hound has conducted widespread scanning to identify public-facing systems vulnerable to CVE-2021-44228 in Log4j and ProxyShell vulnerabilities; CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in on-premises MS Exchange Servers; and CVE-2018-13379 in Fortinet FortiOS SSL VPNs.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
Magic Hound has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Magic Hound has acquired Amazon S3 buckets to use in C2.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
Magic Hound has used multiple web shells to gain execution.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Magic Hound has collected names and passwords of all Wi-Fi networks to which a device has previously connected.
MITRE ATT&CK technique: T1016.002: System Network Configuration Discovery- Wi-Fi Discovery
Magic Hound has used the command-line interface for code execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Magic Hound has used a tool to run `cmd /c wmic computersystem get domain` for discovery.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Malteiro has obtained credentials from mail clients via NirSoft MailPassView.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
Malteiro has stolen credentials stored in the victim’s browsers via software tool NirSoft WebBrowserPassView.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Malteiro has the ability to deobfuscate downloaded files prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Malteiro has injected Mispadu’s DLL into a process.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Malteiro has used scripts encoded in Base64 certificates to distribute malware to victims.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Malteiro targets organizations in a wide variety of sectors via the use of Mispadu banking trojan with the goal of financial theft.
MITRE ATT&CK technique: T1657: Financial Theft
Malteiro has relied on users to execute .zip file attachments containing malicious URLs.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Malteiro collects the installed antivirus on the victim machine.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Malteiro has sent spearphishing emails containing malicious .zip files.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Malteiro collects the machine information, system architecture, the OS version, computer name, and Windows product name.
MITRE ATT&CK technique: T1082: System Information Discovery
Malteiro will terminate Mispadu's infection process if the language of the victim machine is not Spanish or Portuguese.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Malteiro has utilized a dropper containing malicious VBS scripts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Metador has encrypted their payloads.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Metador has quickly deleted `cbd.exe` from a compromised host following the successful deployment of their malware.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Metador has downloaded tools and malware onto a compromised system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Metador has used unique malware in their operations, including metaMain and Mafalda.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
Metador has used TCP for C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
Metador has used Microsoft's Console Debugger in some of their operations.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Metador has used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Metador has used the Windows command line to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Metador has established persistence through the use of a WMI event subscription combined with unusual living-off-the-land binaries such as `cdb.exe`.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
Moafee has been known to employ binary padding.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Mofang has compressed the ShimRat executable within malicious email attachments. Mofang has also encrypted payloads before they are downloaded to victims.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File