sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
INC Ransom has named a PsExec executable winupd to mimic a legitimate Windows update file.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
INC Ransom has used NETSCAN.EXE for internal reconnaissance.
MITRE ATT&CK technique: T1046: Network Service Discovery
INC Ransom has used Internet Explorer to view folders on other systems.
MITRE ATT&CK technique: T1135: Network Share Discovery
INC Ransom has used phishing to gain initial access.
MITRE ATT&CK technique: T1566: Phishing
INC Ransom has used AnyDesk and PuTTY on compromised systems.
MITRE ATT&CK technique: T1219: Remote Access Software
INC Ransom has used RDP to move laterally.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
INC Ransom has run a file encryption executable via `Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem`.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
INC Ransom has used RDP to test network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
INC Ransom has acquired and used several tools including MegaSync, AnyDesk, esentutl and PsExec.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
INC Ransom has used Megasync to exfiltrate data to the cloud.
MITRE ATT&CK technique: T1537: Transfer Data to Cloud Account
INC Ransom has used compromised valid accounts for access to victim environments.
MITRE ATT&CK technique: T1078: Valid Accounts
INC Ransom has used `cmd.exe` to launch malicious payloads.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
INC Ransom has used WMIC to deploy ransomware.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Inception used a browser plugin to steal passwords and sessions from Internet Explorer, Chrome, Opera, Firefox, Torch, and Yandex.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Inception used a file hunting plugin to collect .txt, .pdf, .xls or .doc files from the infected host.
MITRE ATT&CK technique: T1005: Data from Local System
Inception has used specific malware modules to gather domain membership.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Inception has encrypted malware payloads dropped on victim machines with AES and RC4 encryption.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Inception has exploited CVE-2012-0158, CVE-2014-1761, CVE-2017-11882 and CVE-2018-0802 for execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Inception used a file listing plugin to collect information about file and directories both on local and remote drives.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Inception lured victims into clicking malicious files for machine reconnaissance and to execute malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Inception has used malicious HTA files to drop and execute malware.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Inception used chains of compromised routers to proxy C2 communications between them and cloud service providers.
MITRE ATT&CK technique: T1090.003: Proxy- Multi-hop Proxy
Inception has used PowerShell to execute malicious commands and payloads.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Inception has used a reconnaissance module to identify active processes and other associated loaded modules.
MITRE ATT&CK technique: T1057: Process Discovery
Inception has maintained persistence by modifying Registry run key value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Inception has ensured persistence at system boot by setting the value regsvr32 %path%\ctfmonrn.dll /s.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Inception has enumerated installed software on compromised systems.
MITRE ATT&CK technique: T1518: Software Discovery
Inception has used weaponized documents attached to spearphishing emails for reconnaissance and initial compromise.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Inception has encrypted network communications with AES.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Inception has used a reconnaissance module to gather information about the operating system and hardware on the infected host.
MITRE ATT&CK technique: T1082: System Information Discovery
Inception has used decoy documents to load malicious remote payloads via HTTP.
MITRE ATT&CK technique: T1221: Template Injection
Inception has obtained and used open-source tools such as LaZagne.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Inception has used VBScript to execute malicious commands and payloads.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Inception has used HTTP, HTTPS, and WebDav in network communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Inception has incorporated at least five different cloud service providers into their C2 infrastructure including CloudMe.
MITRE ATT&CK technique: T1102: Web Service
IndigoZebra has established domains, some of which were designed to look like official government domains, for their operations.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
IndigoZebra has compromised legitimate email accounts to use in their spearphishing operations.
MITRE ATT&CK technique: T1586.002: Compromise Accounts- Email Accounts
IndigoZebra has downloaded additional files and tools from its C2 server.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
IndigoZebra sent spearphishing emails containing malicious attachments that urged recipients to review modifications in the file which would trigger the attack.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
IndigoZebra sent spearphishing emails containing malicious password-protected RAR attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
IndigoZebra has acquired open source tools such as NBTscan and Meterpreter for their operations.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
IndigoZebra created Dropbox accounts for their operations.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
Indrik Spider has purchased access to victim VPNs to facilitate access to victim environments.
MITRE ATT&CK technique: T1583: Acquire Infrastructure
Indrik Spider has used Cobalt Strike to empty log files. Additionally, Indrik Spider has cleared all event logs using `wevutil`.
MITRE ATT&CK technique: T1070.001: Indicator Removal- Clear Windows Event Logs
Indrik Spider used wmic.exe to add a new user to the system.
MITRE ATT&CK technique: T1136: Create Account
Indrik Spider has searched files to obtain and exfiltrate credentials.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Indrik Spider has encrypted domain-controlled systems using BitPaymer. Additionally, Indrik Spider used PsExec to execute a ransomware script.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
Indrik Spider used PsExec to leverage Windows Defender to disable scanning of all downloaded files and to restrict real-time monitoring. Indrik Spider has used `MpCmdRun` to revert the definitions in Microsoft Defender. Additionally, Indrik Spider has used WMI to stop or uninstall and reset anti-virus products and other defensive services.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Indrik Spider has collected credentials from infected systems, including domain accounts.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
Indrik Spider has created email accounts to communicate with their ransomware victims, to include providing payment and decryption details.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
Indrik Spider has exfiltrated data using Rclone or MEGASync prior to deploying ransomware.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Indrik Spider has downloaded tools, such as the Advanced Port Scanner utility and Lansweeper, to conduct internal reconnaissance of the victim network. Indrik Spider has also accessed the victim’s VMware VCenter, which had information about host configuration, clusters, etc.
MITRE ATT&CK technique: T1590: Gather Victim Network Information
Indrik Spider has used Group Policy Objects to deploy batch scripts.
MITRE ATT&CK technique: T1484.001: Domain or Tenant Policy Modification- Group Policy Modification
Indrik Spider has downloaded additional scripts, malware, and tools onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Indrik Spider has used malicious JavaScript files for several components of their attack.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Indrik Spider has conducted Kerberoasting attacks using a module from GitHub.
MITRE ATT&CK technique: T1558.003: Steal or Forge Kerberos Tickets- Kerberoasting
Indrik Spider used Cobalt Strike to carry out credential dumping using ProcDump.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Indrik Spider has created local system accounts and has added the accounts to privileged groups.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Indrik Spider has stored collected data in a .tmp file.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Indrik Spider has attempted to get users to click on a malicious zipped file.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Indrik Spider has developed malware for their operations, including ransomware such as BitPaymer and WastedLocker.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Indrik Spider used fake updates for FlashPlayer plugin and Google Chrome as initial infection vectors.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Indrik Spider has modified registry keys to prepare for ransomware execution and to disable common administrative utilities.
MITRE ATT&CK technique: T1112: Modify Registry
Indrik Spider has accessed and exported passwords from password managers.
MITRE ATT&CK technique: T1555.005: Credentials from Password Stores- Password Managers
Indrik Spider has used PowerShell Empire for execution of malware.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Indrik Spider has used a service account to extract copies of the `Security` Registry hive.
MITRE ATT&CK technique: T1012: Query Registry
Indrik Spider has used RDP for lateral movement.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Indrik Spider has used PowerView to enumerate all Windows Server, Windows Server 2003, and Windows 7 instances in the Active Directory database.
MITRE ATT&CK technique: T1018: Remote System Discovery
Indrik Spider has used SSH for lateral movement.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
Indrik Spider has served fake updates via legitimate websites that have been compromised.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
Indrik Spider has used PsExec to stop services prior to the execution of ransomware.
MITRE ATT&CK technique: T1489: Service Stop
Indrik Spider has used the win32_service WMI class to retrieve a list of services from the system.
MITRE ATT&CK technique: T1007: System Service Discovery
Indrik Spider has used valid accounts for initial access and lateral movement. Indrik Spider has also maintained access to the victim environment through the VPN infrastructure.
MITRE ATT&CK technique: T1078: Valid Accounts
Indrik Spider has used batch scripts on victim's machines.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Indrik Spider has used WMIC to execute commands on remote computers.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
The Ke3chang group has been known to compress data before exfiltration.
MITRE ATT&CK technique: T1560: Archive Collected Data
Ke3chang is known to use 7Zip and RAR with passwords to encrypt data prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Ke3chang has performed frequent and scheduled data collection from victim networks.
MITRE ATT&CK technique: T1119: Automated Collection
Ke3chang has performed frequent and scheduled data exfiltration from compromised networks.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Ke3chang has used compromised credentials to sign into victims’ Microsoft 365 accounts.
MITRE ATT&CK technique: T1078.004: Valid Accounts- Cloud Accounts
Malware used by Ke3chang can run commands on the command-line interface.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Ke3chang malware RoyalDNS has used DNS for C2.
MITRE ATT&CK technique: T1071.004: Application Layer Protocol- DNS
Ke3chang gathered information and files from local directories for exfiltration.
MITRE ATT&CK technique: T1005: Data from Local System
Ke3chang has deobfuscated Base64-encoded shellcode strings prior to loading them.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Ke3chang performs discovery of permission groups net group /domain.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
Ke3chang transferred compressed and encrypted RAR files containing exfiltration through the established backdoor command and control channel during operations.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Ke3chang has compromised networks by exploiting Internet-facing applications, including vulnerable Microsoft Exchange and SharePoint servers.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Ke3chang has gained access through VPNs including with compromised accounts and stolen VPN certificates.
MITRE ATT&CK technique: T1133: External Remote Services
Ke3chang uses command-line interaction to search files and directories.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Ke3chang has used Mimikatz to generate Kerberos golden tickets.
MITRE ATT&CK technique: T1558.001: Steal or Forge Kerberos Tickets- Golden Ticket
Ke3chang has used tools to download files to compromised machines.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Ke3chang has used keyloggers.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Ke3chang has dumped credentials, including by using gsecdump.
MITRE ATT&CK technique: T1003.004: OS Credential Dumping- LSA Secrets
Ke3chang has dumped credentials, including by using Mimikatz.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Ke3chang performs account discovery using commands such as net localgroup administrators and net group "REDACTED" /domain on specific permissions groups.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Ke3chang has dropped their malware into legitimate installed software paths including: `C:\ProgramFiles\Realtek\Audio\HDA\AERTSr.exe`, `C:\Program Files \Foxit Software\Foxit Reader\FoxitRdr64.exe`, `C:\Program Files \Adobe\Flash Player\AddIns\airappinstaller\airappinstall.exe`, and `C:\Program Files \Adobe\Acrobat Reader DC\Reader\AcroRd64.exe`.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Ke3chang has used NTDSDump and other password dumping tools to gather credentials.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
Ke3chang has used Base64-encoded shellcode strings.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Ke3chang performs process discovery using tasklist commands.
MITRE ATT&CK technique: T1057: Process Discovery
Several Ke3chang backdoors achieved persistence by adding a Run key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Ke3chang has used compromised credentials and a .NET tool to dump data from Microsoft Exchange mailboxes.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
Ke3chang has used network scanning and enumeration tools, including Ping.
MITRE ATT&CK technique: T1018: Remote System Discovery
Ke3chang has used the right-to-left override character in spearphishing attachment names to trick targets into executing .scr and .exe files.
MITRE ATT&CK technique: T1036.002: Masquerading- Right-to-Left Override
Ke3chang actors have been known to copy files to the network shares of other computers to move laterally.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Ke3chang has dumped credentials, including by using gsecdump.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
Ke3chang has used a tool known as RemoteExec ) to remotely execute batch scripts and binaries.
MITRE ATT&CK technique: T1569.002: System Services- Service Execution
Ke3chang used a SharePoint enumeration and data dumping tool known as spwebmember.
MITRE ATT&CK technique: T1213.002: Data from Information Repositories- Sharepoint
Ke3chang performs operating system information discovery using systeminfo and has used implants to identify the system language and computer name.
MITRE ATT&CK technique: T1082: System Information Discovery
Ke3chang has used implants to collect the system language ID of a compromised machine.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
Ke3chang has performed local network configuration discovery using ipconfig.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Ke3chang performs local network connection discovery using netstat.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
Ke3chang has used implants capable of collecting the signed-in username.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Ke3chang performs service discovery using net start commands.
MITRE ATT&CK technique: T1007: System Service Discovery
Ke3chang has obtained and used tools such as Mimikatz.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Ke3chang has used credential dumpers or stealers to obtain legitimate credentials, which they used to gain access to victim accounts.
MITRE ATT&CK technique: T1078: Valid Accounts
Ke3chang malware including RoyalCli and BS2005 have communicated over HTTP with the C2 server through Internet Explorer by using the COM interface IWebBrowser2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Ke3chang has used batch scripts in its malware to install persistence mechanisms.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Ke3chang backdoor RoyalDNS established persistence through adding a service called Nwsapagent.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
Kimsuky has used funds from stolen and laundered cryptocurrency to acquire operational infrastructure.
MITRE ATT&CK technique: T1583: Acquire Infrastructure
Kimsuky has added accounts to specific groups with net localgroup.
MITRE ATT&CK technique: T1098.007: Account Manipulation- Additional Local or Domain Groups
Kimsuky has used modified versions of PHProxy to examine web traffic between the victim and the accessed website.
MITRE ATT&CK technique: T1557: Adversary-in-the-Middle
Kimsuky has used RC4 encryption before exfil.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Kimsuky has used QuickZip to archive stolen files before exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Kimsuky has used Blogspot pages for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Kimsuky has used Google Chrome browser extensions to infect victims and to steal passwords and cookies.
MITRE ATT&CK technique: T1176: Browser Extensions
Kimsuky has a HWP document stealer module which changes the default program association in the registry to open HWP documents.
MITRE ATT&CK technique: T1546.001: Event Triggered Execution- Change Default File Association
Kimsuky has signed files with the name EGIS CO,. Ltd..
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Kimsuky has used tools that are capable of obtaining credentials from saved mail.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Kimsuky has used browser extensions including Google Chrome to steal passwords and cookies from browsers. Kimsuky has also used Nirsoft's WebBrowserPassView tool to dump the passwords obtained from victims.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
Kimsuky has collected Office, PDF, and HWP documents from its victims.
MITRE ATT&CK technique: T1005: Data from Local System
Kimsuky has decoded malicious VBScripts using Base64.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Kimsuky created and used a mailing toolkit to use in spearphishing attacks.
MITRE ATT&CK technique: T1587: Develop Capabilities
Kimsuky has been observed disabling the system firewall.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Kimsuky has been observed turning off Windows Security Center and can hide the AV software window from the view of the infected user.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Kimsuky has registered domains to spoof targeted organizations and trusted third parties including search engines, web platforms, and cryptocurrency exchanges.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Kimsuky has compromised legitimate sites and used them to distribute malware.
MITRE ATT&CK technique: T1584.001: Compromise Infrastructure- Domains
Kimsuky has compromised email accounts to send spearphishing e-mails.
MITRE ATT&CK technique: T1586.002: Compromise Accounts- Email Accounts
Kimsuky has created email accounts for phishing operations.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
Kimsuky has collected valid email addresses including personal accounts that were subsequently used for spearphishing and other forms of social engineering.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
Kimsuky has set auto-forward rules on victim's e-mail accounts.
MITRE ATT&CK technique: T1114.003: Email Collection- Email Forwarding Rule
Kimsuky has collected victim employee name information.
MITRE ATT&CK technique: T1589.003: Gather Victim Identity Information- Employee Names
Kimsuky has exfiltrated data over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Kimsuky has exfiltrated stolen files and data to actor-controlled Blogspot accounts.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
Kimsuky has exploited various vulnerabilities for initial access, including Microsoft Exchange vulnerability CVE-2020-0688.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Kimsuky has obtained exploit code for various CVEs.
MITRE ATT&CK technique: T1588.005: Obtain Capabilities- Exploits
Kimsuky has used RDP to establish persistence.
MITRE ATT&CK technique: T1133: External Remote Services
Kimsuky has deleted the exfiltrated data on disk after transmission. Kimsuky has also used an instrumentor script to terminate browser processes running on an infected system and then delete the cookie files on disk.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Kimsuky has used FTP to download additional malware to the target machine.
MITRE ATT&CK technique: T1071.002: Application Layer Protocol- File Transfer Protocols
Kimsuky has the ability to enumerate all files and directories on an infected system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Kimsuky has stolen and laundered cryptocurrency to self-fund operations including the acquisition of infrastructure.
MITRE ATT&CK technique: T1657: Financial Theft
Kimsuky has collected victim organization information including but not limited to organization hierarchy, functions, press releases, and others.
MITRE ATT&CK technique: T1591: Gather Victim Org Information
Kimsuky has run reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v to hide a newly created user.
MITRE ATT&CK technique: T1564.002: Hide Artifacts- Hidden Users
Kimsuky has used an information gathering module that will hide an AV software window from the victim.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Kimsuky has sent internal spearphishing emails for lateral movement after stealing victim information.
MITRE ATT&CK technique: T1534: Internal Spearphishing
Kimsuky has used JScript for logging and downloading additional tools.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Kimsuky has used a PowerShell-based keylogger as well as a tool called MECHANICAL to log keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Kimsuky has gathered credentials using Mimikatz and ProcDump.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Kimsuky has created accounts with net user.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Kimsuky has used a tool called GREASE to add a Windows admin account in order to allow them continued access via RDP.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
Kimsuky has staged collected data files under C:\Program Files\Common Files\System\Ole DB\.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
Kimsuky has used e-mail to send exfiltrated data to C2 servers.
MITRE ATT&CK technique: T1071.003: Application Layer Protocol- Mail Protocols
Kimsuky has used attempted to lure victims into opening malicious e-mail attachments.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Kimsuky has lured victims into clicking malicious links.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
Kimsuky has disguised services to appear as benign software or related to operating system functions.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Kimsuky has renamed malware to legitimate names such as ESTCommon.dll or patch.dll.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence.
MITRE ATT&CK technique: T1112: Modify Registry
Kimsuky has used mshta.exe to run malicious scripts on the system.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Kimsuky has used a proprietary tool to intercept one time passwords required for two-factor authentication.
MITRE ATT&CK technique: T1111: Multi-Factor Authentication Interception
Kimsuky has used the Nirsoft SniffPass network sniffer to obtain passwords sent over non-secure protocols.
MITRE ATT&CK technique: T1040: Network Sniffing
Kimsuky has obfuscated binary strings including the use of XOR encryption and Base64 encoding. Kimsuky has also modified the first byte of DLL implants targeting victims to prevent recognition of the executable file format.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Kimsuky has used pass the hash for authentication to remote access software used in C2.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
Kimsuky has used tailored spearphishing emails to gather victim information including contat lists to identify additional targets.
MITRE ATT&CK technique: T1598: Phishing for Information
Kimsuky has executed a variety of PowerShell scripts including Invoke-Mimikatz.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Kimsuky can gather a list of all processes running on a victim's machine.
MITRE ATT&CK technique: T1057: Process Discovery
Kimsuky has used a file injector DLL to spawn a benign process on the victim's system and inject the malicious payload into it via process hollowing.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Kimsuky has used Win7Elevate to inject malicious code into explorer.exe.
MITRE ATT&CK technique: T1055: Process Injection
Kimsuky has used a macOS Python implant to gather data as well as MailFetcher.py code to automatically collect email data.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
Kimsuky has obtained specific Registry keys and values on a compromised host.
MITRE ATT&CK technique: T1012: Query Registry
Kimsuky has used the Invoke-Mimikatz PowerShell script to reflectively load a Mimikatz credential stealing DLL into memory.
MITRE ATT&CK technique: T1620: Reflective Code Loading
Kimsuky has placed scripts in the startup folder for persistence and modified the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce` Registry key.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Kimsuky has executed malware with regsvr32s.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
Kimsuky has used a modified TeamViewer client as a command and control channel.
MITRE ATT&CK technique: T1219: Remote Access Software
Kimsuky has used RDP for direct remote point-and-click access.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Kimsuky has used tools such as the MailFetch mail crawler to collect victim emails from online services via IMAP.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
Kimsuky has used `rundll32.exe` to execute malicious scripts and malware on a victim's network.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Kimsuky has downloaded additional malware with scheduled tasks.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Kimsuky has searched for vulnerabilities, tools, and geopolitical trends on Google to target victims.
MITRE ATT&CK technique: T1593.002: Search Open Websites/Domains- Search Engines
Kimsuky has searched for information on the target company's website.
MITRE ATT&CK technique: T1594: Search Victim-Owned Websites
Kimsuky has checked for the presence of antivirus software with powershell Get-CimInstance -Namespace root/securityCenter2 – classname antivirusproduct.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
Kimsuky has purchased hosting servers with virtual currency and prepaid cards.
MITRE ATT&CK technique: T1583.004: Acquire Infrastructure- Server
Kimsuky has used Twitter to monitor potential victims and to prepare targeted phishing e-mails.
MITRE ATT&CK technique: T1593.001: Search Open Websites/Domains- Social Media
Kimsuky has created social media accounts to monitor news and security trends as well as potential targets.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
Kimsuky has packed malware with UPX.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
Kimsuky has used emails containing Word, Excel and/or HWP documents in their spearphishing campaigns.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Kimsuky has sent spearphishing emails containing a link to a document that contained malicious macros or took the victim to an actor-controlled domain.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
Kimsuky has used links in e-mail to steal account information including web beacons for target profiling.
MITRE ATT&CK technique: T1598.003: Phishing for Information- Spearphishing Link
Kimsuky has enumerated drives, OS type, OS version, and other information using a script or the "systeminfo" command.
MITRE ATT&CK technique: T1082: System Information Discovery
Kimsuky has used `ipconfig/all` and web beacons sent via email to gather network configuration information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Kimsuky has used an instrumentor script to gather the names of all services running on a victim's system.
MITRE ATT&CK technique: T1007: System Service Discovery
Kimsuky has manipulated timestamps for creation or compilation dates to defeat anti-forensics.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Kimsuky has used compromised and acquired infrastructure to host and deliver malware including Blogspot to host beacons, file exfiltrators, and implants.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
Kimsuky has used Visual Basic to download malicious payloads. Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Kimsuky has used HTTP GET and POST requests for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Kimsuky has hosted content used for targeting efforts via web services such as Blogspot.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
Kimsuky has used modified versions of open source PHP web shells to maintain access, often adding "Dinosaur" references within the code.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Kimsuky has executed Windows commands by using `cmd` and running batch scripts.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Kimsuky has created new services for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
LAPSUS$ has removed a targeted organization's global admin accounts to lock the organization out of all access.
MITRE ATT&CK technique: T1531: Account Access Removal
LAPSUS$ has added the global admin role to accounts they have created in the targeted organization's cloud instances.
MITRE ATT&CK technique: T1098.003: Account Manipulation- Additional Cloud Roles
LAPSUS$ has gathered detailed knowledge of an organization's supply chain relationships.
MITRE ATT&CK technique: T1591.002: Gather Victim Org Information- Business Relationships
LAPSUS$ has targeted various collaboration tools like Slack, Teams, JIRA, Confluence, and others to hunt for exposed credentials to support privilege escalation and lateral movement.
MITRE ATT&CK technique: T1552.008: Unsecured Credentials- Chat Messages
LAPSUS$ has created global admin accounts in the targeted organization's cloud instances to gain persistence.
MITRE ATT&CK technique: T1136.003: Create Account- Cloud Account
LAPSUS$ has used compromised credentials to access cloud assets within a target organization.
MITRE ATT&CK technique: T1078.004: Valid Accounts- Cloud Accounts
LAPSUS$ has searched public code repositories for exposed credentials.
MITRE ATT&CK technique: T1593.003: Search Open Websites/Domains- Code Repositories
LAPSUS$ has searched a victim's network for code repositories like GitLab and GitHub to discover further high-privilege account credentials.
MITRE ATT&CK technique: T1213.003: Data from Information Repositories- Code Repositories
LAPSUS$ has searched a victim's network for collaboration platforms like Confluence and JIRA to discover further high-privilege account credentials.
MITRE ATT&CK technique: T1213.001: Data from Information Repositories- Confluence
LAPSUS$ has created new virtual machines within the target's cloud environment after leveraging credential access to cloud assets.
MITRE ATT&CK technique: T1578.002: Modify Cloud Compute Infrastructure- Create Cloud Instance
LAPSUS$ has gathered user identities and credentials to gain initial access to a victim's organization; the group has also called an organization's help desk to reset a target's credentials.
MITRE ATT&CK technique: T1589.001: Gather Victim Identity Information- Credentials
LAPSUS$ has obtained passwords and session tokens with the use of the Redline password stealer.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
LAPSUS$ has used DCSync attacks to gather credentials for privilege escalation routines.
MITRE ATT&CK technique: T1003.006: OS Credential Dumping- DCSync
LAPSUS$ has reconfigured a victim's DNS records to actor-controlled domains and websites.
MITRE ATT&CK technique: T1584.002: Compromise Infrastructure- DNS Server
LAPSUS$ has deleted the target's systems and resources both on-premises and in the cloud.
MITRE ATT&CK technique: T1485: Data Destruction
LAPSUS$ uploaded sensitive files, information, and credentials from a targeted organization for extortion or public release.
MITRE ATT&CK technique: T1005: Data from Local System
LAPSUS$ has deleted the target's systems and resources in the cloud to trigger the organization's incident and crisis response process.
MITRE ATT&CK technique: T1578.003: Modify Cloud Compute Infrastructure- Delete Cloud Instance
LAPSUS$ has used the AD Explorer tool to enumerate users on a victim's network.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
LAPSUS$ has used the AD Explorer tool to enumerate groups on a victim's network.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
LAPSUS$ has payed employees, suppliers, and business partners of target organizations for credentials.
MITRE ATT&CK technique: T1586.002: Compromise Accounts- Email Accounts
LAPSUS$ has gathered employee email addresses, including personal accounts, for social engineering and initial access efforts.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
LAPSUS$ has set an Office 365 tenant level mail transport rule to send all mail in and out of the targeted organization to the newly created account.
MITRE ATT&CK technique: T1114.003: Email Collection- Email Forwarding Rule
LAPSUS$ has exploited unpatched vulnerabilities on internally accessible servers including JIRA, GitLab, and Confluence for privilege escalation.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
LAPSUS$ has gained access to internet-facing systems and applications, including virtual private network , remote desktop protocol , and virtual desktop infrastructure including Citrix.
MITRE ATT&CK technique: T1133: External Remote Services
LAPSUS$ has gathered detailed information of target employees to enhance their social engineering lures.
MITRE ATT&CK technique: T1589: Gather Victim Identity Information
LAPSUS$ has gathered detailed knowledge of team structures within a target organization.
MITRE ATT&CK technique: T1591.004: Gather Victim Org Information- Identify Roles
LAPSUS$ has called victims' help desk and impersonated legitimate users with previously gathered information in order to gain access to privileged accounts.
MITRE ATT&CK technique: T1656: Impersonation
LAPSUS$ acquired and used the Redline password stealer in their operations.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
LAPSUS$ has searched a victim's network for organization collaboration channels like MS Teams or Slack to discover further high-privilege account credentials.
MITRE ATT&CK technique: T1213.005: Data from Information Repositories- Messaging Applications
LAPSUS$ has replayed stolen session token and passwords to trigger simple-approval MFA prompts in hope of the legitimate user will grant necessary approval.
MITRE ATT&CK technique: T1111: Multi-Factor Authentication Interception
LAPSUS$ has spammed target users with MFA prompts in the hope that the legitimate user will grant necessary approval.
MITRE ATT&CK technique: T1621: Multi-Factor Authentication Request Generation
LAPSUS$ has used Windows built-in tool `ntdsutil` to extract the Active Directory database.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
LAPSUS$ has accessed local password managers and databases to obtain further credentials from a compromised network.
MITRE ATT&CK technique: T1555.005: Credentials from Password Stores- Password Managers
LAPSUS$ has leverage NordVPN for its egress points when targeting intended victims.
MITRE ATT&CK technique: T1090: Proxy
LAPSUS$ has purchased credentials and session tokens from criminal underground forums.
MITRE ATT&CK technique: T1597.002: Search Closed Sources- Purchase Technical Data
LAPSUS$ has shut down virtual machines from within a victim's on-premise VMware ESXi infrastructure.
MITRE ATT&CK technique: T1489: Service Stop
LAPSUS$ has searched a victim's network for collaboration platforms like SharePoint to discover further high-privilege account credentials.
MITRE ATT&CK technique: T1213.002: Data from Information Repositories- Sharepoint
LAPSUS$ has called victims' help desk to convince the support personnel to reset a privileged account’s credentials.
MITRE ATT&CK technique: T1598.004: Phishing for Information- Spearphishing Voice
LAPSUS$ has obtained tools such as RVTools and AD Explorer for their operations.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
LAPSUS$ has accessed internet-facing identity providers such as Azure Active Directory and Okta to target specific organizations.
MITRE ATT&CK technique: T1199: Trusted Relationship
LAPSUS$ has recruited target organization employees or contractors who provide credentials and approve an associated MFA prompt, or install remote management software onto a corporate workstation, allowing LAPSUS$ to take control of an authenticated system.
MITRE ATT&CK technique: T1204: User Execution
LAPSUS$ has used compromised credentials and/or session tokens to gain access into a victim's VPN, VDI, RDP, and IAMs.
MITRE ATT&CK technique: T1078: Valid Accounts
LAPSUS$ has used VPS hosting providers for infrastructure.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.
MITRE ATT&CK technique: T1098: Account Manipulation
Lazarus Group malware IndiaIndia obtains and sends to its C2 server the title of the window for each running process. The KilaAlfa keylogger also reports the title of the window in the foreground.
MITRE ATT&CK technique: T1010: Application Window Discovery
Lazarus Group has compressed exfiltrated data with RAR and used RomeoDelta malware to archive specified directories in .zip format, encrypt the .zip file, and upload it to C2.
MITRE ATT&CK technique: T1560: Archive Collected Data
A Lazarus Group malware sample encrypts data using a simple byte based XOR operation prior to exfiltration.
MITRE ATT&CK technique: T1560.003: Archive Collected Data- Archive via Custom Method
Lazarus Group malware IndiaIndia saves information gathered about the victim to a file that is compressed with Zlib, encrypted, and uploaded to a C2 server.
MITRE ATT&CK technique: T1560.002: Archive Collected Data- Archive via Library
Lazarus Group has used GitHub as C2, pulling hosted image payloads then committing command execution output to files in specific directories.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
Lazarus Group malware WhiskeyAlfa-Three modifies sector 0 of the Master Boot Record to ensure that the malware will persist even if a victim machine shuts down.
MITRE ATT&CK technique: T1542.003: Pre-OS Boot- Bootkit
Lazarus Group has routinely deleted log files on a compromised router, including automatic log deletion through the use of the logrotate utility.
MITRE ATT&CK technique: T1070.003: Indicator Removal- Clear Command History
Lazarus Group has digitally signed malware and utilities to evade detection.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
Lazarus Group keylogger KiloAlfa obtains user tokens from interactive sessions to execute itself with API call CreateProcessAsUserA under that user's context.
MITRE ATT&CK technique: T1134.002: Access Token Manipulation- Create Process with Token
Lazarus Group has replaced `win_fw.dll`, an internal component that is executed during IDA Pro installation, with a malicious DLL to download and execute a payload.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Lazarus Group has used a custom secure delete function to overwrite file contents with data from heap memory.
MITRE ATT&CK technique: T1485: Data Destruction
Lazarus Group has collected data and files from compromised networks.
MITRE ATT&CK technique: T1005: Data from Local System
Lazarus Group has used shellcode within macros to decrypt and manually map DLLs and shellcode into memory at runtime.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Lazarus Group has obtained SSL certificates for their C2 domains.
MITRE ATT&CK technique: T1588.004: Obtain Capabilities- Digital Certificates
Various Lazarus Group malware modifies the Windows firewall to allow incoming connections or disable it entirely using netsh.
MITRE ATT&CK technique: T1562.004: Impair Defenses- Disable or Modify System Firewall
Lazarus Group malware TangoDelta attempts to terminate various processes associated with McAfee. Additionally, Lazarus Group malware SHARPKNOT disables the Microsoft Windows System Event Notification and Alerter services..
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Lazarus Group has used malware like WhiskeyAlfa to overwrite the first 64MB of every drive with a mix of static and random buffers. A similar process is then used to wipe content in logical drives and, finally, attempt to wipe every byte of every sector on every drive. WhiskeyBravo can be used to overwrite the first 4.9MB of physical drives. WhiskeyDelta can overwrite the first 132MB or 1.5MB of each drive with random data from heap memory.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
Lazarus Group malware SHARPKNOT overwrites and deletes the Master Boot Record on the victim's machine and has possessed MBR wiper malware since at least 2009.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
Lazarus Group has acquired domains related to their campaigns to act as distribution points and C2 channels.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Lazarus Group delivered RATANKBA and other malicious code to victims via a compromised legitimate website.
MITRE ATT&CK technique: T1189: Drive-by Compromise
Lazarus Group has used a custom hashing method to resolve APIs used in shellcode.
MITRE ATT&CK technique: T1027.007: Obfuscated Files or Information- Dynamic API Resolution
A Lazarus Group malware sample performs reflective DLL injection.
MITRE ATT&CK technique: T1055.001: Process Injection- Dynamic-link Library Injection
Lazarus Group has created new email accounts for spearphishing operations.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
Lazarus Group collected email addresses belonging to various departments of a targeted organization which were used in follow-on phishing campaigns.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
Lazarus Group has used multiple types of encryption and encoding for their payloads, including AES, Caracachs, RC4, XOR, Base64, and other tricks such as creating aliases in code for Native API function names.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Lazarus Group has exfiltrated data and files over a C2 channel through its various tools and malware.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel