sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
FIN8 has used FTP to exfiltrate collected data.
MITRE ATT&CK technique: T1048.003: Exfiltration Over Alternative Protocol- Exfiltration Over Unencrypted Non-C2 Protocol
FIN8 has exploited the CVE-2016-0167 local vulnerability.
MITRE ATT&CK technique: T1068: Exploitation for Privilege Escalation
FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
FIN8 has used remote code execution to download subsequent payloads.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
FIN8 has used the Ping command to check connectivity to actor-controlled C2 servers.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor .
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
FIN8 has used malicious e-mail attachments to lure victims into executing malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
FIN8 has used emails with malicious links to lure victims into installing malware.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
FIN8 has deleted Registry keys during post compromise cleanup activities.
MITRE ATT&CK technique: T1112: Modify Registry
FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
FIN8 aggregates staged data from a network into a single location.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
FIN8 has used RDP for lateral movement.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.
MITRE ATT&CK technique: T1018: Remote System Discovery
FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context. FIN8 has also used smbexec from the Impacket suite for lateral movement.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
FIN8 has used scheduled tasks to maintain RDP backdoors.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
FIN8 has used PowerShell Scripts to check the architecture of a compromised machine before the selection of a 32-bit or 64-bit version of a malicious .NET loader.
MITRE ATT&CK technique: T1082: System Information Discovery
FIN8 has executed the command `quser` to display the session details of a compromised machine.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
FIN8 has used open-source tools such as Impacket for targeting efforts.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
FIN8 has used valid accounts for persistence and lateral movement.
MITRE ATT&CK technique: T1078: Valid Accounts
FIN8 has used HTTPS for command and control.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
FIN8 has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.
MITRE ATT&CK technique: T1102: Web Service
FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via `cmd.exe`.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
FIN8's malicious spearphishing payloads use WMI to launch malware and spawn `cmd.exe` execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
FIN8 has used WMI event subscriptions for persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
Ferocious Kitten has acquired domains imitating legitimate sites.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Ferocious Kitten has attempted to convince victims to enable malicious content within a spearphishing email by including an odd decoy message.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Ferocious Kitten has named malicious files update.exe and loaded them into the compromise host's “Public” folder.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Ferocious Kitten has used right-to-left override to reverse executables’ names to make them appear to have different file extensions, rather than their real ones.
MITRE ATT&CK technique: T1036.002: Masquerading- Right-to-Left Override
Ferocious Kitten has conducted spearphishing campaigns containing malicious documents to lure victims to open the attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Ferocious Kitten has obtained open source tools for its operations, including JsonCPP and Psiphon.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Fox Kitten has used sticky keys to launch a command prompt.
MITRE ATT&CK technique: T1546.008: Event Triggered Execution- Accessibility Features
Fox Kitten has used 7-Zip to archive data.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Fox Kitten has used Google Chrome bookmarks to identify internal resources and assets.
MITRE ATT&CK technique: T1217: Browser Information Discovery
Fox Kitten has brute forced RDP credentials.
MITRE ATT&CK technique: T1110: Brute Force
Fox Kitten has base64 encoded scripts to avoid detection.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Fox Kitten has used a Perl reverse shell to communicate with C2.
MITRE ATT&CK technique: T1059: Command and Scripting Interpreter
Fox Kitten has accessed files to gain valid credentials.
MITRE ATT&CK technique: T1552.001: Unsecured Credentials- Credentials In Files
Fox Kitten has obtained files from the victim's cloud storage instances.
MITRE ATT&CK technique: T1530: Data from Cloud Storage
Fox Kitten has searched local system resources to access sensitive documents.
MITRE ATT&CK technique: T1005: Data from Local System
Fox Kitten has searched network shares to access sensitive documents.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
Fox Kitten has used the Softerra LDAP browser to browse documentation on service accounts.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
Fox Kitten has base64 encoded payloads to avoid detection.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Fox Kitten has created KeyBase accounts to communicate with ransomware victims.
MITRE ATT&CK technique: T1585: Establish Accounts
Fox Kitten has exploited known vulnerabilities in Fortinet, PulseSecure, and Palo Alto VPN appliances.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
Fox Kitten has exploited known vulnerabilities in remote services including RDP.
MITRE ATT&CK technique: T1210: Exploitation of Remote Services
Fox Kitten has used WizTree to obtain network files and directory listings.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Fox Kitten has downloaded additional tools including PsExec directly to endpoints.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Fox Kitten has used prodump to dump credentials from LSASS.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
Fox Kitten has accessed ntuser.dat and UserClass.dat on compromised hosts.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
Fox Kitten has created a local user account with administrator privileges.
MITRE ATT&CK technique: T1136.001: Create Account- Local Account
Fox Kitten has named the task for a reverse proxy lpupdate to appear legitimate.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Fox Kitten has named binaries and configuration files svhost and dllhost respectively to appear legitimate.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Fox Kitten has accessed victim security and IT environments and Microsoft Teams to mine valuable information.
MITRE ATT&CK technique: T1213.005: Data from Information Repositories- Messaging Applications
Fox Kitten has used Volume Shadow Copy to access credential information from NTDS.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
Fox Kitten has used tools including NMAP to conduct broad scanning to identify open ports.
MITRE ATT&CK technique: T1046: Network Service Discovery
Fox Kitten has used scripts to access credential information from the KeePass database.
MITRE ATT&CK technique: T1555.005: Credentials from Password Stores- Password Managers
Fox Kitten has used PowerShell scripts to access credential data.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Fox Kitten has used protocol tunneling for communication and RDP activity on compromised hosts through the use of open source tools such as ngrok and custom tool SSHMinion.
MITRE ATT&CK technique: T1572: Protocol Tunneling
Fox Kitten has used the open source reverse proxy tools including FRPC and Go Proxy to establish connections from C2 to local servers.
MITRE ATT&CK technique: T1090: Proxy
Fox Kitten has accessed Registry hives ntuser.dat and UserClass.dat.
MITRE ATT&CK technique: T1012: Query Registry
Fox Kitten has used RDP to log in and move laterally in the target environment.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
Fox Kitten has used Angry IP Scanner to detect remote systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
Fox Kitten has used valid accounts to access SMB shares.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
Fox Kitten has used the PuTTY and Plink tools for lateral movement.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
Fox Kitten has used Scheduled Tasks for persistence and to load and execute a reverse proxy binary.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Fox Kitten has used a Twitter account to communicate with ransomware victims.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
Fox Kitten has installed TightVNC server and client on compromised servers and endpoints for lateral movement.
MITRE ATT&CK technique: T1021.005: Remote Services- VNC
Fox Kitten has used valid credentials with various services during lateral movement.
MITRE ATT&CK technique: T1078: Valid Accounts
Fox Kitten has used Amazon Web Services to host C2.
MITRE ATT&CK technique: T1102: Web Service
Fox Kitten has installed web shells on compromised hosts to maintain access.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
Fox Kitten has used cmd.exe likely as a password changing mechanism.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
GALLIUM used WinRAR to compress and encrypt stolen data prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
GALLIUM has used stolen certificates to sign its tools including those from Whizzimo LLC.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
GALLIUM used DLL side-loading to covertly load PoisonIvy into memory on the victim machine.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
GALLIUM collected data from the victim's local system, including password hashes from the SAM hive in the Registry.
MITRE ATT&CK technique: T1005: Data from Local System
GALLIUM created high-privileged domain user accounts to maintain access to victim networks.
MITRE ATT&CK technique: T1136.002: Create Account- Domain Account
GALLIUM used Web shells and HTRAN for C2 and to exfiltrate data.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
GALLIUM exploited a publicly-facing servers including Wildfly/JBoss servers to gain access to the network.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
GALLIUM used a modified version of HTRAN to redirect connections between networks.
MITRE ATT&CK technique: T1090.002: Proxy- External Proxy
GALLIUM has used VPN services, including SoftEther VPN, to access and maintain persistence in victim environments.
MITRE ATT&CK technique: T1133: External Remote Services
GALLIUM ensured each payload had a unique hash, including by using different types of packers.
MITRE ATT&CK technique: T1027.005: Obfuscated Files or Information- Indicator Removal from Tools
GALLIUM dropped additional tools to victims during their operation, including portqry.exe, a renamed cmd.exe file, winrar, and HTRAN.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
GALLIUM used a modified version of Mimikatz along with a PowerShell-based Mimikatz to dump credentials on the victim machines.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
GALLIUM has used PsExec to move laterally between hosts in the target network.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
GALLIUM compressed and staged files in multi-part archives in the Recycle Bin prior to exfiltration.
MITRE ATT&CK technique: T1074.001: Data Staged- Local Data Staging
GALLIUM used a modified version of HTRAN in which they obfuscated strings such as debug messages in an apparent attempt to evade detection.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
GALLIUM used dumped hashes to authenticate to other machines via pass the hash.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
GALLIUM used PowerShell for execution to assist in lateral movement as well as for dumping credentials stored on compromised machines.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
GALLIUM used a modified version of NBTscan to identify available NetBIOS name servers over the network as well as ping to identify remote systems.
MITRE ATT&CK technique: T1018: Remote System Discovery
GALLIUM used a renamed cmd.exe file to evade detection.
MITRE ATT&CK technique: T1036.003: Masquerading- Rename System Utilities
GALLIUM established persistence for PoisonIvy by created a scheduled task.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
GALLIUM used reg commands to dump specific hives from the Windows Registry, such as the SAM hive, and obtain password hashes.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
GALLIUM has used Taiwan-based servers that appear to be exclusive to GALLIUM.
MITRE ATT&CK technique: T1583.004: Acquire Infrastructure- Server
GALLIUM packed some payloads using different types of packers, both known and custom.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
GALLIUM used ipconfig /all to obtain information about the victim network configuration. The group also ran a modified version of NBTscan to identify available NetBIOS name servers.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
GALLIUM used netstat -oan to obtain information about the victim network connections.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
GALLIUM used whoami and query user to obtain information about the victim user.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
GALLIUM has used a variety of widely-available tools, which in some cases they modified to add functionality and/or subvert antimalware solutions.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
GALLIUM leveraged valid accounts to maintain access to a victim network.
MITRE ATT&CK technique: T1078: Valid Accounts
GALLIUM used Web shells to persist in victim environments and assist in execution and exfiltration.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
GALLIUM used the Windows command shell to execute commands.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
GALLIUM used WMI for execution to assist in lateral movement as well as for installing tools across multiple assets.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
GCMAN uses Putty for lateral movement.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
GCMAN uses VNC for lateral movement.
MITRE ATT&CK technique: T1021.005: Remote Services- VNC
GOLD SOUTHFIELD has executed base64 encoded PowerShell scripts on compromised hosts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
GOLD SOUTHFIELD has distributed ransomware by backdooring software installers via a strategic web compromise of the site hosting Italian WinRAR.
MITRE ATT&CK technique: T1195.002: Supply Chain Compromise- Compromise Software Supply Chain
GOLD SOUTHFIELD has exploited Oracle WebLogic vulnerabilities for initial compromise.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
GOLD SOUTHFIELD has used publicly-accessible RDP and remote management and monitoring servers to gain access to victim machines.
MITRE ATT&CK technique: T1133: External Remote Services
GOLD SOUTHFIELD has conducted malicious spam campaigns to gain access to victim's machines.
MITRE ATT&CK technique: T1566: Phishing
GOLD SOUTHFIELD has staged and executed PowerShell scripts on compromised hosts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
GOLD SOUTHFIELD has used the cloud-based remote management and monitoring tool "ConnectWise Control" to deploy REvil.
MITRE ATT&CK technique: T1219: Remote Access Software
GOLD SOUTHFIELD has used the remote monitoring and management tool ConnectWise to obtain screen captures from victim's machines.
MITRE ATT&CK technique: T1113: Screen Capture
GOLD SOUTHFIELD has breached Managed Service Providers to deliver malware to MSP customers.
MITRE ATT&CK technique: T1199: Trusted Relationship
Gallmaker has used WinZip, likely to archive data prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
Gallmaker attempted to exploit Microsoft’s DDE protocol in order to gain access to victim machines and for execution.
MITRE ATT&CK technique: T1559.002: Inter-Process Communication- Dynamic Data Exchange
Gallmaker sent victims a lure document with a warning that asked victims to “enable content” for execution.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Gallmaker obfuscated shellcode used during execution.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Gallmaker used PowerShell to download additional payloads and for execution.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Gallmaker sent emails with malicious Microsoft Office documents attached.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Gamaredon Group has deployed scripts on compromised systems that automatically scan for interesting documents.
MITRE ATT&CK technique: T1119: Automated Collection
Gamaredon Group has used modules that automatically upload gathered documents to the C2 server.
MITRE ATT&CK technique: T1020: Automated Exfiltration
Gamaredon Group has obfuscated .NET executables by inserting junk code.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Gamaredon Group has used obfuscated or encrypted scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
Gamaredon Group has compiled the source code for a downloader directly on the infected system using the built-in Microsoft.CSharp.CSharpCodeProvider class.
MITRE ATT&CK technique: T1027.004: Obfuscated Files or Information- Compile After Delivery
Gamaredon Group malware can insert malicious macros into documents using a Microsoft.Office.Interop object.
MITRE ATT&CK technique: T1559.001: Inter-Process Communication- Component Object Model
Gamaredon Group has used obfuscated VBScripts with randomly generated variable names and concatenated strings.
MITRE ATT&CK technique: T1001: Data Obfuscation
Gamaredon Group has collected files from infected systems and uploaded them to a C2 server.
MITRE ATT&CK technique: T1005: Data from Local System
Gamaredon Group malware has collected Microsoft Office documents from mapped network drives.
MITRE ATT&CK technique: T1039: Data from Network Shared Drive
A Gamaredon Group file stealer has the capability to steal data from newly connected logical volumes on a system, including USB drives.
MITRE ATT&CK technique: T1025: Data from Removable Media
Gamaredon Group tools decrypted additional payloads from the C2. Gamaredon Group has also decoded base64-encoded source code of a downloader. Additionally, Gamaredon Group has decoded Telegram content to reveal the IP address for C2 communications.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Gamaredon Group has delivered macros which can tamper with Microsoft Office security settings.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Gamaredon Group has used tools to delete files and folders from victims' desktops and profiles.
MITRE ATT&CK technique: T1561.001: Disk Wipe- Disk Content Wipe
Gamaredon Group has registered multiple domains to facilitate payload staging and C2.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
Gamaredon Group has incorporated dynamic DNS domains in its infrastructure.
MITRE ATT&CK technique: T1568: Dynamic Resolution
Gamaredon Group has used geoblocking to limit downloads of the malicious file to specific geographic locations.
MITRE ATT&CK technique: T1480: Execution Guardrails
A Gamaredon Group file stealer can transfer collected files to a hardcoded C2 server.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Gamaredon Group has used fast flux DNS to mask their command and control channel behind rotating IP addresses.
MITRE ATT&CK technique: T1568.001: Dynamic Resolution- Fast Flux DNS
Gamaredon Group tools can delete files used during an operation.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files found on a system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
Gamaredon Group has used hidcon to run batch files in a hidden console window.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Gamaredon Group has downloaded additional malware and tools onto a compromised host. For example, Gamaredon Group uses a backdoor script to retrieve and decode additional payloads once in victim environments.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Gamaredon Group has left taunting images and messages on the victims' desktops as proof of system access.
MITRE ATT&CK technique: T1491.001: Defacement- Internal Defacement
Gamaredon Group has used an Outlook VBA module on infected systems to send phishing emails with malicious attachments to other employees within the organization.
MITRE ATT&CK technique: T1534: Internal Spearphishing
Gamaredon Group has tested connectivity between a compromised machine and a C2 server using Ping with commands such as `CSIDL_SYSTEM\cmd.exe /c ping -n 1`.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
Gamaredon Group has attempted to get users to click on Office attachments with malicious macros embedded.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Gamaredon Group has attempted to get users to click on a link pointing to a malicious HTML file leading to follow-on malicious content.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
Gamaredon Group has used legitimate process names to hide malware including svchosst.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
Gamaredon Group has removed security settings for VBA macro execution by changing registry values HKCU\Software\Microsoft\Office\<version>\<product>\Security\VBAWarnings and HKCU\Software\Microsoft\Office\<version>\<product>\Security\AccessVBOM.
MITRE ATT&CK technique: T1112: Modify Registry
Gamaredon Group has used `mshta.exe` to execute malicious files.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
Gamaredon Group malware has used CreateProcess to launch additional malicious components.
MITRE ATT&CK technique: T1106: Native API
Gamaredon Group has delivered self-extracting 7z archive files within malicious document attachments.
MITRE ATT&CK technique: T1027: Obfuscated Files or Information
Gamaredon Group has inserted malicious macros into existing documents, providing persistence when they are reopened. Gamaredon Group has loaded the group's previously delivered VBA project by relaunching Microsoft Outlook with the /altvba option, once the Application.Startup event is received.
MITRE ATT&CK technique: T1137: Office Application Startup
Gamaredon Group has used Telegram Messenger content to discover the IP address for C2 communications.
MITRE ATT&CK technique: T1102.003: Web Service- One-Way Communication
Gamaredon Group tools have contained an application to check performance of USB flash drives. Gamaredon Group has also used malware to scan for removable drives.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
Gamaredon Group has used obfuscated PowerShell scripts for staging.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Gamaredon Group has used tools to enumerate processes on target hosts including Process Explorer.
MITRE ATT&CK technique: T1057: Process Discovery
Gamaredon Group tools have registered Run keys in the registry to give malicious VBS files persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Gamaredon Group malware has used rundll32 to launch additional malicious components.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
Gamaredon Group has created scheduled tasks to launch executables after a designated number of minutes have passed.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Gamaredon Group's malware can take screenshots of the compromised computer every minute.
MITRE ATT&CK technique: T1113: Screen Capture
Gamaredon Group has delivered spearphishing emails with malicious attachments to targets.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
A Gamaredon Group file stealer can gather the victim's computer name and drive serial numbers to send to a C2 server.
MITRE ATT&CK technique: T1082: System Information Discovery
A Gamaredon Group file stealer can gather the victim's username to send to a C2 server.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
Gamaredon Group has injected malicious macros into all Word and Excel documents on mapped network drives.
MITRE ATT&CK technique: T1080: Taint Shared Content
Gamaredon Group has used DOCX files to download malicious DOT document templates and has used RTF template injection to download malicious payloads. Gamaredon Group can also inject malicious macros or remote templates into documents already present on compromised systems.
MITRE ATT&CK technique: T1221: Template Injection
Gamaredon Group has used various legitimate tools, such as `mshta.exe` and Reg, and services during operations.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Gamaredon Group has registered domains to stage payloads.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
Gamaredon Group has used VNC tools, including UltraVNC, to remotely interact with compromised hosts.
MITRE ATT&CK technique: T1021.005: Remote Services- VNC
Gamaredon Group has used VPS hosting providers for infrastructure outside of Russia.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
Gamaredon Group has embedded malicious macros in document templates, which executed VBScript. Gamaredon Group has also delivered Microsoft Outlook VBA projects with embedded macros.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Gamaredon Group has used HTTP and HTTPS for C2 communications.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Gamaredon Group has used GitHub repositories for downloaders which will be obtained by the group's .NET executable on the compromised system.
MITRE ATT&CK technique: T1102: Web Service
Gamaredon Group has used various batch scripts to establish C2 and download additional files. Gamaredon Group's backdoor malware has also been written to a batch file.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Gamaredon Group has used WMI to execute scripts used for discovery and for determining the C2 IP address.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
Gorgon Group malware can decode contents from a payload that was Base64 encoded and write the contents to a file.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Gorgon Group malware can attempt to disable security features in Microsoft Office and Windows Defender using the taskkill command.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
Gorgon Group has used -W Hidden to conceal PowerShell windows by setting the WindowStyle parameter to hidden.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Gorgon Group malware can download additional files from C2 servers.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
Gorgon Group attempted to get users to launch malicious Microsoft Office attachments delivered via spearphishing emails.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Gorgon Group malware can deactivate security mechanisms in Microsoft Office by editing several keys and values under HKCU\Software\Microsoft\Office\.
MITRE ATT&CK technique: T1112: Modify Registry
Gorgon Group malware can leverage the Windows API call, CreateProcessA, for execution.
MITRE ATT&CK technique: T1106: Native API
Gorgon Group malware can download a remote access tool, ShiftyBug, and inject into another process.
MITRE ATT&CK technique: T1055.002: Process Injection- Portable Executable Injection
Gorgon Group malware can use PowerShell commands to download and execute a payload and open a decoy document on the victim’s machine.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
Gorgon Group malware can use process hollowing to inject one of its trojans into another process.
MITRE ATT&CK technique: T1055.012: Process Injection- Process Hollowing
Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Gorgon Group malware can create a .lnk file and add a Registry Run key to establish persistence.
MITRE ATT&CK technique: T1547.009: Boot or Logon Autostart Execution- Shortcut Modification
Gorgon Group sent emails to victims with malicious Microsoft Office documents attached.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Gorgon Group has obtained and used tools such as QuasarRAT and Remcos.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
Gorgon Group has used macros in Spearphishing Attachments as well as executed VBScripts on victim machines.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Gorgon Group malware can use cmd.exe to download and execute payloads and to execute commands on the system.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Group5 disguised its malicious binaries with several layers of obfuscation, including encrypting the files.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Malware used by Group5 is capable of remotely deleting files from victims.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
Malware used by Group5 is capable of capturing keystrokes.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
Malware used by Group5 is capable of watching the victim's screen.
MITRE ATT&CK technique: T1113: Screen Capture
HAFNIUM has granted privileges to domain accounts.
MITRE ATT&CK technique: T1098: Account Manipulation
HAFNIUM has used 7-Zip and WinRAR to compress stolen files for exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
HAFNIUM has interacted with Office 365 tenants to gather details regarding target's environments.
MITRE ATT&CK technique: T1592.004: Gather Victim Host Information- Client Configurations
HAFNIUM has collected data and files from a compromised machine.
MITRE ATT&CK technique: T1005: Data from Local System
HAFNIUM has created domain accounts.
MITRE ATT&CK technique: T1136.002: Create Account- Domain Account
HAFNIUM has collected e-mail addresses for users they intended to target.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
HAFNIUM has exfiltrated data to file sharing sites, including MEGA.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
HAFNIUM has exploited CVE-2021-44228 in Log4j and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 to compromise on-premises versions of Microsoft Exchange Server.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
HAFNIUM has searched file contents on a compromised host.
MITRE ATT&CK technique: T1083: File and Directory Discovery
HAFNIUM gathered the fully qualified domain names for targeted Exchange servers in the victim's environment.
MITRE ATT&CK technique: T1590: Gather Victim Network Information
HAFNIUM has hidden files on a compromised host.
MITRE ATT&CK technique: T1564.001: Hide Artifacts- Hidden Files and Directories
HAFNIUM has obtained IP addresses for publicly-accessible Exchange servers.
MITRE ATT&CK technique: T1590.005: Gather Victim Network Information- IP Addresses
HAFNIUM has downloaded malware and tools--including Nishang and PowerCat--onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
HAFNIUM has checked for network connectivity from a compromised host using `ping`, including attempts to contact `google.com`.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
HAFNIUM has used procdump to dump the LSASS process memory.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
HAFNIUM has used the NT AUTHORITY\SYSTEM account to create files on Exchange servers.
MITRE ATT&CK technique: T1078.003: Valid Accounts- Local Accounts
HAFNIUM has stolen copies of the Active Directory database .
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
HAFNIUM has used TCP for C2.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
HAFNIUM has used the Exchange Power Shell module Set-OabVirtualDirectoryPowerShell to export mailbox data.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
HAFNIUM has used `tasklist` to enumerate processes.
MITRE ATT&CK technique: T1057: Process Discovery
HAFNIUM has used web shells to export mailbox data.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
HAFNIUM has enumerated domain controllers using `net group "Domain computers"` and `nltest /dclist`.
MITRE ATT&CK technique: T1018: Remote System Discovery
HAFNIUM has used rundll32 to load malicious DLLs.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
HAFNIUM has used ASCII encoding for C2 traffic.
MITRE ATT&CK technique: T1132.001: Data Encoding- Standard Encoding
HAFNIUM has collected IP information via IPInfo.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
HAFNIUM has used `whoami` to gather user information.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
HAFNIUM has operated from leased virtual private servers in the United States.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
HAFNIUM has used open-source C2 frameworks, including Covenant.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
HAFNIUM has acquired web services for use in C2 and exfiltration.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
HAFNIUM has deployed multiple web shells on compromised servers including SIMPLESEESHARP, SPORTSBALL, China Chopper, and ASPXSpy.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
HAFNIUM has used `cmd.exe` to execute commands on the victim's machine.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
HEXANE has used a PowerShell-based keylogging tool to capture the window title.
MITRE ATT&CK technique: T1010: Application Window Discovery
HEXANE has used cloud services, including OneDrive, for C2.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
HEXANE has used brute force attacks to compromise valid credentials.
MITRE ATT&CK technique: T1110: Brute Force
HEXANE has used Base64-encoded scripts.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
HEXANE has run `cmdkey` on victim machines to identify stored credentials.
MITRE ATT&CK technique: T1555: Credentials from Password Stores
HEXANE has used a Mimikatz-based tool and a PowerShell script to steal passwords from Google Chrome.
MITRE ATT&CK technique: T1555.003: Credentials from Password Stores- Credentials from Web Browsers
HEXANE has set up custom DNS servers to send commands to compromised hosts via TXT records.
MITRE ATT&CK technique: T1583.002: Acquire Infrastructure- DNS Server
HEXANE has registered and operated domains for campaigns, often using a security or web technology theme or impersonating the targeted organization.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
HEXANE has used compromised accounts to send spearphishing emails.
MITRE ATT&CK technique: T1586.002: Compromise Accounts- Email Accounts
HEXANE has established email accounts for use in domain registration including for ProtonMail addresses.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
HEXANE has targeted executives, human resources staff, and IT personnel for spearphishing.
MITRE ATT&CK technique: T1589.002: Gather Victim Identity Information- Email Addresses
HEXANE has used cloud services, including OneDrive, for data exfiltration.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
HEXANE has identified specific potential victims at targeted organizations.
MITRE ATT&CK technique: T1589: Gather Victim Identity Information
HEXANE has identified executives, HR, and IT staff at victim organizations for further targeting.
MITRE ATT&CK technique: T1591.004: Gather Victim Org Information- Identify Roles
HEXANE has downloaded additional payloads and malicious scripts onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
HEXANE has conducted internal spearphishing attacks against executives, HR, and IT personnel to gain information and access.
MITRE ATT&CK technique: T1534: Internal Spearphishing
HEXANE has used tools including BITSAdmin to test internet connectivity from compromised hosts.
MITRE ATT&CK technique: T1016.001: System Network Configuration Discovery- Internet Connection Discovery
HEXANE has used a PowerShell-based keylogger named `kl.ps1`.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
HEXANE has run `net localgroup` to enumerate local groups.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
HEXANE has relied on victim's executing malicious file attachments delivered via email or embedded within actor-controlled websites to deliver malware.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
HEXANE has used password spraying attacks to obtain valid credentials.
MITRE ATT&CK technique: T1110.003: Brute Force- Password Spraying
HEXANE has used PowerShell-based tools and scripts for discovery and collection on compromised hosts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
HEXANE has enumerated processes on targeted systems.
MITRE ATT&CK technique: T1057: Process Discovery
HEXANE has used remote desktop sessions for lateral movement.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
HEXANE has used `net view` to enumerate domain machines.
MITRE ATT&CK technique: T1018: Remote System Discovery
HEXANE has used a scheduled task to establish persistence for a keylogger.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
HEXANE has established fraudulent LinkedIn accounts impersonating HR department employees to target potential victims with fake job offers.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
HEXANE has enumerated programs installed on an infected machine.
MITRE ATT&CK technique: T1518: Software Discovery
HEXANE has collected the hostname of a compromised machine.
MITRE ATT&CK technique: T1082: System Information Discovery
HEXANE has used Ping and `tracert` for network discovery.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
HEXANE has used netstat to monitor connections to specific ports.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
HEXANE has run `whoami` on compromised machines to identify the current user.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
HEXANE has acquired, and sometimes customized, open source tools such as Mimikatz, Empire, VNC remote access software, and DIG.net.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
HEXANE has staged malware on fraudulent websites set up to impersonate targeted organizations.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
HEXANE has used a VisualBasic script named `MicrosoftUpdator.vbs` for execution of a PowerShell keylogger.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
HEXANE has used WMI event subscriptions for persistence.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
Higaisa performed padding with null bytes before calculating its hash.
MITRE ATT&CK technique: T1027.001: Obfuscated Files or Information- Binary Padding
Higaisa’s JavaScript file used a legitimate Microsoft Office 2007 package to side-load the OINFO12.OCX dynamic link library.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
Higaisa used certutil to decode Base64 binaries at runtime and a 16-byte XOR key to decrypt data.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
Higaisa used Base64 encoded compressed payloads.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
Higaisa exfiltrated data over its C2 channel.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
Higaisa has exploited CVE-2018-0798 for execution.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
Higaisa used a payload that creates a hidden window.
MITRE ATT&CK technique: T1564.003: Hide Artifacts- Hidden Window
Higaisa discovered system proxy settings and used them if available.
MITRE ATT&CK technique: T1090.001: Proxy- Internal Proxy
Higaisa used JavaScript to execute additional files.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
Higaisa used malicious e-mail attachments to lure victims into executing LNK files.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
Higaisa named a shellcode loader binary svchast.exe to spoof the legitimate svchost.exe.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
Higaisa has called various native OS APIs.
MITRE ATT&CK technique: T1106: Native API
Higaisa’s shellcode attempted to find the process ID of the current process.
MITRE ATT&CK technique: T1057: Process Discovery
Higaisa used a FakeTLS session for C2 communications.
MITRE ATT&CK technique: T1001.003: Data Obfuscation- Protocol or Service Impersonation
Higaisa added a spoofed binary to the start-up folder for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
Higaisa dropped and added officeupdate.exe to scheduled tasks.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
Higaisa sent the victim computer identifier in a User-Agent string back to the C2 server every 10 minutes.
MITRE ATT&CK technique: T1029: Scheduled Transfer
Higaisa has sent spearphishing emails containing malicious attachments.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
Higaisa used AES-128 to encrypt C2 traffic.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
Higaisa collected the system volume serial number, GUID, and computer name.
MITRE ATT&CK technique: T1082: System Information Discovery
Higaisa used ipconfig to gather network configuration information.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
Higaisa used a function to gather the current time.
MITRE ATT&CK technique: T1124: System Time Discovery
Higaisa has used VBScript code on the victim's machine.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
Higaisa used HTTP and HTTPS to send data back to its C2 server.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
Higaisa used cmd.exe for execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
Higaisa used an XSL file to run VBScript code.
MITRE ATT&CK technique: T1220: XSL Script Processing
INC Ransom has used valid accounts over RDP to connect to targeted systems.
MITRE ATT&CK technique: T1071: Application Layer Protocol
INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
INC Ransom has used INC Ransomware to encrypt victim's data.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
INC Ransom has staged data on compromised hosts prior to exfiltration.
MITRE ATT&CK technique: T1074: Data Staged
INC Ransom can use SystemSettingsAdminFlows.exe, a native Windows utility, to disable Windows Defender.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
INC Ransom has scanned for domain admin accounts in compromised environments.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
INC Ransom has enumerated domain groups on targeted hosts.
MITRE ATT&CK technique: T1069.002: Permission Groups Discovery- Domain Groups
INC Ransom has exploited known vulnerabilities including CVE-2023-3519 in Citrix NetScaler for initial access.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
INC Ransom has uninstalled tools from compromised endpoints after use.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
INC Ransom has stolen and encrypted victim's data in order to extort payment for keeping it private or decrypting it.
MITRE ATT&CK technique: T1657: Financial Theft
INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer