sarahwei/cyber_MITRE_technique_CTI_dataset_v16 huggingface dataset:
During Cutting Edge, threat actors modified a JavaScript file on the Web SSL VPN component of Ivanti Connect Secure devices to keylog credentials.
MITRE ATT&CK technique: T1056.001: Input Capture- Keylogging
During Cutting Edge, threat actors used Task Manager to dump LSASS memory from Windows devices to disk.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
During Cutting Edge, threat actors accessed and mounted virtual hard disk backups to extract ntds.dit.
MITRE ATT&CK technique: T1003.003: OS Credential Dumping- NTDS
During Cutting Edge, threat actors used compromised and out-of-support Cyberoam VPN appliances for C2.
MITRE ATT&CK technique: T1584.008: Compromise Infrastructure- Network Devices
During Cutting Edge, threat actors used the Unix socket and a reverse TCP shell for C2 communications.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
During Cutting Edge, threat actors used malicious SparkGateway plugins to inject shared objects into web process memory on compromised Ivanti Secure Connect VPNs to enable deployment of backdoors.
MITRE ATT&CK technique: T1055: Process Injection
During Cutting Edge, threat actors used Iodine to tunnel IPv4 traffic over DNS.
MITRE ATT&CK technique: T1572: Protocol Tunneling
During Cutting Edge, threat actors used a Python reverse shell and the PySoxy SOCKS5 proxy tool.
MITRE ATT&CK technique: T1059.006: Command and Scripting Interpreter- Python
During Cutting Edge, threat actors used RDP with compromised credentials for lateral movement.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
During Cutting Edge, threat actors moved laterally using compromised credentials to connect to internal Windows systems with SMB.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
During Cutting Edge, threat actors used SSH for lateral movement.
MITRE ATT&CK technique: T1021.004: Remote Services- SSH
During Cutting Edge, threat actors peformed reconnaissance of victims' internal websites via proxied connections.
MITRE ATT&CK technique: T1594: Search Victim-Owned Websites
During Cutting Edge, threat actors used the ENUM4LINUX Perl script for discovery on Windows and Samba hosts.
MITRE ATT&CK technique: T1082: System Information Discovery
During Cutting Edge, threat actors changed timestamps of multiple files on compromised Ivanti Secure Connect VPNs to conceal malicious activity.
MITRE ATT&CK technique: T1070.006: Indicator Removal- Timestomp
During Cutting Edge, threat actors leveraged tools including Interactsh to identify vulnerable targets, PySoxy to simultaneously dispatch traffic between multiple endpoints, BusyBox to enable post exploitation activities, and Kubo Injector to inject shared objects into process memory.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During Cutting Edge, threat actors sent a magic 48-byte sequence to enable the PITSOCK backdoor to communicate via the `/tmp/clientsDownload.sock` socket.
MITRE ATT&CK technique: T1205: Traffic Signaling
During Cutting Edge, threat actors used the publicly available Interactsh tool to identify Ivanti Connect Secure VPNs vulnerable to CVE-2024-21893.
MITRE ATT&CK technique: T1595.002: Active Scanning- Vulnerability Scanning
During Cutting Edge, threat actors modified the JavaScript loaded by the Ivanti Connect Secure login page to capture credentials entered.
MITRE ATT&CK technique: T1056.003: Input Capture- Web Portal Capture
During Cutting Edge, threat actors used multiple web shells to maintain presence on compromised Connect Secure appliances such as WIREFIRE, GLASSTOKEN, BUSHWALK, LIGHTWIRE, and FRAMESTING.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.
MITRE ATT&CK technique: T1119: Automated Collection
During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.
MITRE ATT&CK technique: T1020: Automated Exfiltration
During Frankenstein, the threat actors ran encoded commands from the command line.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
During Frankenstein, the threat actors used Empire to gather various local system information.
MITRE ATT&CK technique: T1005: Data from Local System
During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
During Frankenstein, the threat actors exploited CVE-2017-11882 to execute code on the victim's machine.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
During Frankenstein, the threat actors downloaded files and tools onto a victim machine.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During Frankenstein, the threat actors used MSbuild to execute an actor-created file.
MITRE ATT&CK technique: T1127.001: Trusted Developer Utilities Proxy Execution- MSBuild
During Frankenstein, the threat actors relied on a victim to enable macros within a malicious Microsoft Word document likely sent via email.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
During Frankenstein, the threat actors named a malicious scheduled task "WinUpdate" for persistence.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
During Frankenstein, the threat actors used Empire to obtain a list of all running processes.
MITRE ATT&CK technique: T1057: Process Discovery
During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named "WinUpdate"
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
During Frankenstein, the threat actors used WMI queries to determine if analysis tools were running on a compromised system.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
During Frankenstein, the threat actors used Empire to obtain the compromised machine's name.
MITRE ATT&CK technique: T1082: System Information Discovery
During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website.
MITRE ATT&CK technique: T1221: Template Injection
For Frankenstein, the threat actors obtained and used Empire.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
During Frankenstein, the threat actors used HTTP GET requests for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
During FunnyDream, the threat actors used 7zr.exe to add collected files to an archive.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
For FunnyDream, the threat actors registered a variety of domains.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
For FunnyDream, the threat actors likely established an identified email account to register a variety of domains that were used during the campaign.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
During FunnyDream, the threat actors downloaded additional droppers and backdoors onto a compromised system.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
For FunnyDream, the threat actors used a new backdoor named FunnyDream.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
During FunnyDream, the threat actors used Tasklist on targeted systems.
MITRE ATT&CK technique: T1057: Process Discovery
During FunnyDream, the threat actors used several tools and batch files to map victims' internal networks.
MITRE ATT&CK technique: T1018: Remote System Discovery
During FunnyDream, the threat actors used Systeminfo to collect information on targeted hosts.
MITRE ATT&CK technique: T1082: System Information Discovery
During FunnyDream, the threat actors used ipconfig for discovery on remote systems.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
During FunnyDream, the threat actors used netstat to discover network connections on remote systems.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
For FunnyDream, the threat actors used a modified version of the open source PcShare remote administration tool.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During FunnyDream, the threat actors used a Visual Basic script to run remote commands.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
During FunnyDream, the threat actors used `cmd.exe` to execute the wmiexec.vbs script.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During FunnyDream, the threat actors used `wmiexec.vbs` to run remote commands.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
During HomeLand Justice, threat actors added the `ApplicationImpersonation` management role to accounts under their control to impersonate users and take ownership of targeted mailboxes.
MITRE ATT&CK technique: T1098.002: Account Manipulation- Additional Email Delegate Permissions
During HomeLand Justice, threat actors used tools with legitimate code signing certificates.
MITRE ATT&CK technique: T1588.003: Obtain Capabilities- Code Signing Certificates
During HomeLand Justice, threat actors used ROADSWEEP ransomware to encrypt files on targeted systems.
MITRE ATT&CK technique: T1486: Data Encrypted for Impact
During HomeLand Justice, threat actors used the built-in administrator account to move laterally using RDP and Impacket.
MITRE ATT&CK technique: T1078.001: Valid Accounts- Default Accounts
During HomeLand Justice, threat actors deleted Windows events and application logs.
MITRE ATT&CK technique: T1562.002: Impair Defenses- Disable Windows Event Logging
During HomeLand Justice, threat actors modified and disabled components of endpoint detection and response solutions including Microsoft Defender Antivirus.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
During HomeLand Justice, threat actors used a version of ZeroCleare to wipe disk drives on targeted hosts.
MITRE ATT&CK technique: T1561.002: Disk Wipe- Disk Structure Wipe
During HomeLand Justice, threat actors used compromised Exchange accounts to search mailboxes for administrator accounts.
MITRE ATT&CK technique: T1087.003: Account Discovery- Email Account
During HomeLand Justice, threat actors used HTTP to transfer data from compromised Exchange servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
For HomeLand Justice, threat actors exploited CVE-2019-0604 in Microsoft SharePoint for initial access.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
During HomeLand Justice, threat actors used web shells to download files to compromised infrastructure.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During HomeLand Justice, threat actors dumped LSASS memory on compromised hosts.
MITRE ATT&CK technique: T1003.001: OS Credential Dumping- LSASS Memory
During HomeLand Justice, threat actors initiated a process named Mellona.exe to spread the ROADSWEEP file encryptor and a persistence script to a list of internal machines.
MITRE ATT&CK technique: T1570: Lateral Tool Transfer
During HomeLand Justice, threat actors renamed ROADSWEEP to GoXML.exe and ZeroCleare to cl.exe.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
During HomeLand Justice, threat actors executed the Advanced Port Scanner tool on compromised systems.
MITRE ATT&CK technique: T1046: Network Service Discovery
During HomeLand Justice, threat actors used PowerShell cmdlets New-MailboxSearch and Get-Recipient for discovery.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
During HomeLand Justice, threat actors primarily used RDP for lateral movement in the victim environment.
MITRE ATT&CK technique: T1021.001: Remote Services- Remote Desktop Protocol
During HomeLand Justice, threat actors made multiple HTTP POST requests to the Exchange servers of the victim organization to transfer data.
MITRE ATT&CK technique: T1114.002: Email Collection- Remote Email Collection
During HomeLand Justice, threat actors used SMB for lateral movement.
MITRE ATT&CK technique: T1021.002: Remote Services- SMB/Windows Admin Shares
During HomeLand Justice, threat actors used custom tooling to acquire tokens using `ImpersonateLoggedOnUser/SetThreadToken`.
MITRE ATT&CK technique: T1134.001: Access Token Manipulation- Token Impersonation/Theft
During HomeLand Justice, threat actors used tools including Advanced Port Scanner, Mimikatz, and Impacket.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During HomeLand Justice, threat actors used a compromised Exchange account to search mailboxes and create new Exchange accounts.
MITRE ATT&CK technique: T1078: Valid Accounts
For HomeLand Justice, threat actors used .aspx webshells named pickers.aspx, error4.aspx, and ClientBin.aspx, to maintain persistence.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
During HomeLand Justice, threat actors used Windows batch files for persistence and execution.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During HomeLand Justice, threat actors used WMI to modify Windows Defender settings.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
KV Botnet Activity used various scripts to remove or disable security tools, such as http_watchdog and firewallsd, as well as tools related to other botnet infections, such as mips_ff, on victim devices.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
KV Botnet Activity command and control activity includes transmission of an RSA public key in communication from the server, but this is followed by subsequent negotiation stages that represent a form of handshake similar to TLS negotiation.
MITRE ATT&CK technique: T1573: Encrypted Channel
KV Botnet Activity involves managing events on victim systems via libevent to execute a callback function when any running process contains the following references in their path without also having a reference to bioset: busybox, wget, curl, tftp, telnetd, or lua. If the bioset string is not found, the related process is terminated.
MITRE ATT&CK technique: T1546: Event Triggered Execution
KV Botnet Activity removes on-disk copies of tools and other artifacts after it the primary botnet payload has been loaded into memory on the victim device.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
KV Botnet Activity gathers a list of filenames from the following locations during execution of the final botnet stage: \/usr\/sbin\/, \/usr\/bin\/, \/sbin\/, \/pfrm2.0\/bin\/, \/usr\/local\/bin\/.
MITRE ATT&CK technique: T1083: File and Directory Discovery
KV Botnet Activity included the use of scripts to download additional payloads when compromising network nodes.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
KV Botnet Activity altered permissions on downloaded tools and payloads to enable execution on victim machines.
MITRE ATT&CK technique: T1222.002: File and Directory Permissions Modification- Linux and Mac File and Directory Permissions Modification
KV Botnet Activity installation steps include first identifying, then stopping, any process containing kworker\/0:1, then renaming its initial installation stage to this process name.
MITRE ATT&CK technique: T1036.004: Masquerading- Masquerade Task or Service
KV Botnet Activity involves changing process filename to pr_set_mm_exe_file and process name to pr_set_name during later infection stages.
MITRE ATT&CK technique: T1036: Masquerading
KV Botnet Activity focuses on compromise of small office-home office network devices to build the subsequent botnet.
MITRE ATT&CK technique: T1584.008: Compromise Infrastructure- Network Devices
KV Botnet Activity command and control traffic uses a non-standard, likely custom protocol for communication.
MITRE ATT&CK technique: T1095: Non-Application Layer Protocol
KV Botnet Activity generates a random port number greater than 30,000 to serve as the listener for subsequent command and control activity.
MITRE ATT&CK technique: T1571: Non-Standard Port
KV Botnet Activity final payload installation includes mounting and binding to the \/proc\/ filepath on the victim system to enable subsequent operation in memory while also removing on-disk artifacts.
MITRE ATT&CK technique: T1055.009: Process Injection- Proc Memory
Scripts associated with KV Botnet Activity initial deployment can identify processes related to security tools and other botnet families for follow-on disabling during installation.
MITRE ATT&CK technique: T1057: Process Discovery
KV Botnet Activity involved removal of security tools, as well as other identified IOT malware, from compromised devices.
MITRE ATT&CK technique: T1518.001: Software Discovery- Security Software Discovery
KV Botnet Activity includes use of native system tools, such as uname, to obtain information about victim device architecture, as well as gathering other system information such as the victim's hosts file and CPU utilization.
MITRE ATT&CK technique: T1082: System Information Discovery
KV Botnet Activity gathers victim IP information during initial installation stages.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
KV Botnet Activity utilizes multiple Bash scripts during botnet installation stages, and the final botnet payload allows for running commands in the Bash shell.
MITRE ATT&CK technique: T1059.004: Command and Scripting Interpreter- Unix Shell
KV Botnet Activity used acquired Virtual Private Servers as control systems for devices infected with KV Botnet malware.
MITRE ATT&CK technique: T1583.003: Acquire Infrastructure- Virtual Private Server
During Night Dragon, the threat actors collected files and other data from compromised systems.
MITRE ATT&CK technique: T1005: Data from Local System
During Night Dragon, threat actors disabled anti-virus and anti-spyware tools in some instances on the victim’s machines. The actors also disabled proxy settings to allow direct communication from victims to the Internet.
MITRE ATT&CK technique: T1562.001: Impair Defenses- Disable or Modify Tools
During Night Dragon, threat actors used domain accounts to gain further access to victim systems.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
During Night Dragon, threat actors used dynamic DNS services for C2.
MITRE ATT&CK technique: T1568: Dynamic Resolution
During Night Dragon, threat actors used a DLL that included an XOR-encoded section.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
During Night Dragon, threat actors used SQL injection exploits against extranet web servers to gain access.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.
MITRE ATT&CK technique: T1133: External Remote Services
During Night Dragon, threat actors used company extranet servers as secondary C2 servers.
MITRE ATT&CK technique: T1008: Fallback Channels
During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and browse the victim file system.
MITRE ATT&CK technique: T1083: File and Directory Discovery
During Night Dragon, threat actors used administrative utilities to deliver Trojan components to remote systems.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During Night Dragon, threat actors used RAT malware to exfiltrate email archives.
MITRE ATT&CK technique: T1114.001: Email Collection- Local Email Collection
During Night Dragon, threat actors enticed users to click on links in spearphishing emails to download malware.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
During Night Dragon, threat actors used Trojans from underground hacker websites.
MITRE ATT&CK technique: T1588.001: Obtain Capabilities- Malware
During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and manipulate the Registry.
MITRE ATT&CK technique: T1112: Modify Registry
During Night Dragon, threat actors used pass-the-hash tools to obtain authenticated access to sensitive internal desktops and servers.
MITRE ATT&CK technique: T1550.002: Use Alternate Authentication Material- Pass the Hash
During Night Dragon, threat actors used Cain & Abel to crack password hashes.
MITRE ATT&CK technique: T1110.002: Brute Force- Password Cracking
During Night Dragon, threat actors used several remote administration tools as persistent infiltration channels.
MITRE ATT&CK technique: T1219: Remote Access Software
During Night Dragon, threat actors copied files to company web servers and subsequently downloaded them.
MITRE ATT&CK technique: T1074.002: Data Staged- Remote Data Staging
During Night Dragon, threat actors dumped account hashes using gsecdump.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
During Night Dragon, threat actors purchased hosted services to use for C2.
MITRE ATT&CK technique: T1583.004: Acquire Infrastructure- Server
During Night Dragon, threat actors compromised web servers to use for C2.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
During Night Dragon, threat actors used software packing in its tools.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
During Night Dragon, threat actors sent spearphishing emails containing links to compromised websites where malware was downloaded.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
During Night Dragon, threat actors used password cracking and pass-the-hash tools to discover usernames and passwords.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
During Night Dragon, threat actors obtained and used tools such as gsecdump.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During Night Dragon, threat actors uploaded commonly available hacker tools to compromised web servers.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems.
MITRE ATT&CK technique: T1078: Valid Accounts
During Night Dragon, threat actors used HTTP for C2.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and run command-line shells.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During Operation CuckooBees, the threat actors used the Makecab utility to compress and a version of WinRAR to create password-protected archives of stolen data prior to exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
During Operation CuckooBees, the threat actors executed an encoded VBScript file.
MITRE ATT&CK technique: T1027.010: Obfuscated Files or Information- Command Obfuscation
During Operation CuckooBees, the threat actors used the legitimate Windows services `IKEEXT` and `PrintNotify` to side-load malicious DLLs.
MITRE ATT&CK technique: T1574.002: Hijack Execution Flow- DLL Side-Loading
During Operation CuckooBees, the threat actors collected data, files, and other information from compromised networks.
MITRE ATT&CK technique: T1005: Data from Local System
During Operation CuckooBees, the threat actors used the `dsquery` and `dsget` commands to get domain environment information and to query users in administrative groups.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
During Operation CuckooBees, the threat actors used compromised domain administrator credentials as part of their lateral movement.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
During Operation CuckooBees, the threat actors exploited multiple vulnerabilities in externally facing servers.
MITRE ATT&CK technique: T1190: Exploit Public-Facing Application
During Operation CuckooBees, the threat actors enabled WinRM over HTTP/HTTPS as a backup persistence mechanism using the following command: `cscript //nologo "C:\Windows\System32\winrm.vbs" set winrm/config/service@{EnableCompatibilityHttpsListener="true"}`.
MITRE ATT&CK technique: T1133: External Remote Services
During Operation CuckooBees, the threat actors used `dir c:\\` to search for files.
MITRE ATT&CK technique: T1083: File and Directory Discovery
During Operation CuckooBees, the threat actors stroed payloads in Windows CLFS transactional logs.
MITRE ATT&CK technique: T1027.011: Obfuscated Files or Information- Fileless Storage
During Operation CuckooBees, attackers used a signed kernel rootkit to establish additional persistence.
MITRE ATT&CK technique: T1547.006: Boot or Logon Autostart Execution- Kernel Modules and Extensions
During Operation CuckooBees, the threat actors used the `net user` command to gather account information.
MITRE ATT&CK technique: T1087.001: Account Discovery- Local Account
During Operation CuckooBees, the threat actors used the `net group` command as part of their advanced reconnaissance.
MITRE ATT&CK technique: T1069.001: Permission Groups Discovery- Local Groups
During Operation CuckooBees, the threat actors renamed a malicious executable to `rundll32.exe` to allow it to blend in with other Windows system files.
MITRE ATT&CK technique: T1036.005: Masquerading- Match Legitimate Name or Location
During Operation CuckooBees, the threat actors used the `net share` command as part of their advanced reconnaissance.
MITRE ATT&CK technique: T1135: Network Share Discovery
During Operation CuckooBees, the threat actors used the `net accounts` command as part of their advanced reconnaissance.
MITRE ATT&CK technique: T1201: Password Policy Discovery
During Operation CuckooBees, the threat actors used the `fsutil fsinfo drives` command as part of their advanced reconnaissance.
MITRE ATT&CK technique: T1120: Peripheral Device Discovery
During Operation CuckooBees, the threat actors used the `tasklist` command as part of their advanced reconnaissance.
MITRE ATT&CK technique: T1057: Process Discovery
During Operation CuckooBees, the threat actors used the `net view` and `ping` commands as part of their advanced reconnaissance.
MITRE ATT&CK technique: T1018: Remote System Discovery
During Operation CuckooBees, the threat actors used scheduled tasks to execute batch scripts for lateral movement with the following command: `SCHTASKS /Create /S /U /p /SC ONCE /TN test /TR /ST /RU SYSTEM.`
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
During Operation CuckooBees, the threat actors leveraged a custom tool to dump OS credentials and used following commands: `reg save HKLM\\SYSTEM system.hiv`, `reg save HKLM\\SAM sam.hiv`, and `reg save HKLM\\SECURITY security.hiv`, to dump SAM, SYSTEM and SECURITY hives.
MITRE ATT&CK technique: T1003.002: OS Credential Dumping- Security Account Manager
During Operation CuckooBees, the threat actors used the `systeminfo` command to gather details about a compromised system.
MITRE ATT&CK technique: T1082: System Information Discovery
During Operation CuckooBees, the threat actors used `ipconfig`, `nbtstat`, `tracert`, `route print`, and `cat /etc/hosts` commands.
MITRE ATT&CK technique: T1016: System Network Configuration Discovery
During Operation CuckooBees, the threat actors used the `net session`, `net use`, and `netstat` commands as part of their advanced reconnaissance.
MITRE ATT&CK technique: T1049: System Network Connections Discovery
During Operation CuckooBees, the threat actors used the `query user` and `whoami` commands as part of their advanced reconnaissance.
MITRE ATT&CK technique: T1033: System Owner/User Discovery
During Operation CuckooBees, the threat actors used the `net start` command as part of their initial reconnaissance.
MITRE ATT&CK technique: T1007: System Service Discovery
During Operation CuckooBees, the threat actors used the `net time` command as part of their advanced reconnaissance.
MITRE ATT&CK technique: T1124: System Time Discovery
For Operation CuckooBees, the threat actors obtained publicly-available JSP code that was used to deploy a webshell onto a compromised server.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
During Operation CuckooBees, the threat actors executed an encoded VBScript file using `wscript` and wrote the decoded output to a text file.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
During Operation CuckooBees, the threat actors enabled HTTP and HTTPS listeners.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
During Operation CuckooBees, the threat actors generated a web shell within a vulnerable Enterprise Resource Planning Web Application Server as a persistence mechanism.
MITRE ATT&CK technique: T1505.003: Server Software Component- Web Shell
During Operation CuckooBees, the threat actors used batch scripts to perform reconnaissance.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During Operation CuckooBees, the threat actors modified the `IKEEXT` and `PrintNotify` Windows services for persistence.
MITRE ATT&CK technique: T1543.003: Create or Modify System Process- Windows Service
During Operation Dream Job, Lazarus Group archived victim's data into a RAR file.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
During Operation Dream Job, Lazarus Group performed brute force attacks against administrator accounts.
MITRE ATT&CK technique: T1110: Brute Force
During Operation Dream Job, Lazarus Group digitally signed their own malware to evade detection.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
During Operation Dream Job, Lazarus Group digitally signed their malware and the dbxcli utility.
MITRE ATT&CK technique: T1587.002: Develop Capabilities- Code Signing Certificates
During Operation Dream Job, Lazarus Group used code signing certificates issued by Sectigo RSA for some of its malware and tools.
MITRE ATT&CK technique: T1588.003: Obtain Capabilities- Code Signing Certificates
During Operation Dream Job, Lazarus Group used malicious Trojans and DLL files to exfiltrate data from an infected host.
MITRE ATT&CK technique: T1005: Data from Local System
During Operation Dream Job, Lazarus Group used tools that used the `IsDebuggerPresent` call to detect debuggers.
MITRE ATT&CK technique: T1622: Debugger Evasion
During Operation Dream Job, Lazarus Group queried compromised victim's active directory servers to obtain the list of employees including administrator accounts.
MITRE ATT&CK technique: T1087.002: Account Discovery- Domain Account
During Operation Dream Job, Lazarus Group registered a domain name identical to that of a compromised company as part of their BEC effort.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
For Operation Dream Job, Lazarus Group compromised domains in Italy and other countries for their C2 infrastructure.
MITRE ATT&CK technique: T1584.001: Compromise Infrastructure- Domains
During Operation Dream Job, Lazarus Group created fake email accounts to correspond with fake LinkedIn personas; Lazarus Group also established email accounts to match those of the victim as part of their BEC attempt.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
During Operation Dream Job, Lazarus Group encrypted malware such as DRATzarus with XOR and DLL files with base64.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
During Operation Dream Job, Lazarus Group exfiltrated data from a compromised host to actor-controlled C2 servers.
MITRE ATT&CK technique: T1041: Exfiltration Over C2 Channel
During Operation Dream Job, Lazarus Group used a custom build of open-source command-line dbxcli to exfiltrate stolen data to Dropbox.
MITRE ATT&CK technique: T1567.002: Exfiltration Over Web Service- Exfiltration to Cloud Storage
During Operation Dream Job, Lazarus Group removed all previously delivered files from a compromised computer.
MITRE ATT&CK technique: T1070.004: Indicator Removal- File Deletion
During Operation Dream Job, Lazarus Group conducted word searches within documents on a compromised host in search of security and financial matters.
MITRE ATT&CK technique: T1083: File and Directory Discovery
For Operation Dream Job, Lazarus Group conducted extensive reconnaissance research on potential targets.
MITRE ATT&CK technique: T1589: Gather Victim Identity Information
For Operation Dream Job, Lazarus Group gathered victim organization information to identify specific targets.
MITRE ATT&CK technique: T1591: Gather Victim Org Information
During Operation Dream Job, Lazarus Group targeted Windows servers running Internet Information Systems to install C2 components.
MITRE ATT&CK technique: T1505.004: Server Software Component- IIS Components
During Operation Dream Job, Lazarus Group targeted specific individuals within an organization with tailored job vacancy announcements.
MITRE ATT&CK technique: T1591.004: Gather Victim Org Information- Identify Roles
During Operation Dream Job, Lazarus Group impersonated HR hiring personnel through LinkedIn messages and conducted interviews with victims in order to deceive them into downloading malware.
MITRE ATT&CK technique: T1656: Impersonation
During Operation Dream Job, Lazarus Group downloaded multistage malware and tools onto a compromised host.
MITRE ATT&CK technique: T1105: Ingress Tool Transfer
During Operation Dream Job, Lazarus Group conducted internal spearphishing from within a compromised organization.
MITRE ATT&CK technique: T1534: Internal Spearphishing
During Operation Dream Job, Lazarus Group lured victims into executing malicious documents that contained "dream job" descriptions from defense, aerospace, and other sectors.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
During Operation Dream Job, Lazarus Group lured users into executing a malicious link to disclose private account information or provide initial access.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
During Operation Dream Job, Lazarus Group disguised malicious template files as JPEG files to avoid detection.
MITRE ATT&CK technique: T1036.008: Masquerading- Masquerade File Type
During Operation Dream Job, Lazarus Group used Windows API `ObtainUserAgentString` to obtain the victim's User-Agent and used the value to connect to their C2 server.
MITRE ATT&CK technique: T1106: Native API
During Operation Dream Job, Lazarus Group used PowerShell commands to explore the environment of compromised victims.
MITRE ATT&CK technique: T1059.001: Command and Scripting Interpreter- PowerShell
During Operation Dream Job, Lazarus Group placed LNK files into the victims' startup folder for persistence.
MITRE ATT&CK technique: T1547.001: Boot or Logon Autostart Execution- Registry Run Keys / Startup Folder
During Operation Dream Job, Lazarus Group used `regsvr32` to execute malware.
MITRE ATT&CK technique: T1218.010: System Binary Proxy Execution- Regsvr32
During Operation Dream Job, Lazarus Group executed malware with `C:\\windows\system32\rundll32.exe "C:\ProgramData\ThumbNail\thumbnail.db"`, `CtrlPanel S-6-81-3811-75432205-060098-6872 0 0 905`.
MITRE ATT&CK technique: T1218.011: System Binary Proxy Execution- Rundll32
During Operation Dream Job, Lazarus Group created scheduled tasks to set a periodic execution of a remote XSL script.
MITRE ATT&CK technique: T1053.005: Scheduled Task/Job- Scheduled Task
During Operation Dream Job, Lazarus Group acquired servers to host their malicious tools.
MITRE ATT&CK technique: T1583.004: Acquire Infrastructure- Server
For Operation Dream Job, Lazarus Group compromised servers to host their malicious tools.
MITRE ATT&CK technique: T1584.004: Compromise Infrastructure- Server
For Operation Dream Job, Lazarus Group used LinkedIn to identify and target employees within a chosen organization.
MITRE ATT&CK technique: T1593.001: Search Open Websites/Domains- Social Media
For Operation Dream Job, Lazarus Group created fake LinkedIn accounts for their targeting efforts.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
During Operation Dream Job, Lazarus Group packed malicious .db files with Themida to evade detection.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
During Operation Dream Job, Lazarus Group sent emails with malicious attachments to gain unauthorized access to targets' computers.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
During Operation Dream Job, Lazarus Group sent malicious OneDrive links with fictitious job offer advertisements via email.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
During Operation Dream Job, Lazarus Group sent victims spearphishing messages via LinkedIn concerning fictitious jobs.
MITRE ATT&CK technique: T1566.003: Phishing- Spearphishing via Service
During Operation Dream Job, Lazarus Group used an AES key to communicate with their C2 server.
MITRE ATT&CK technique: T1573.001: Encrypted Channel- Symmetric Cryptography
During Operation Dream Job, Lazarus Group used tools that conducted a variety of system checks to detect sandboxes or VMware services.
MITRE ATT&CK technique: T1497.001: Virtualization/Sandbox Evasion- System Checks
During Operation Dream Job, Lazarus Group deployed malware designed not to run on computers set to Korean, Japanese, or Chinese in Windows language preferences.
MITRE ATT&CK technique: T1614.001: System Location Discovery- System Language Discovery
During Operation Dream Job, Lazarus Group used DOCX files to retrieve a malicious document template/DOTM file.
MITRE ATT&CK technique: T1221: Template Injection
During Operation Dream Job, Lazarus Group used tools that collected `GetTickCount` and `GetSystemTimeAsFileTime` data to detect sandbox or VMware services.
MITRE ATT&CK technique: T1497.003: Virtualization/Sandbox Evasion- Time Based Evasion
For Operation Dream Job, Lazarus Group obtained tools such as Wake-On-Lan, Responder, ChromePass, and dbxcli.
MITRE ATT&CK technique: T1588.002: Obtain Capabilities- Tool
For Operation Dream Job, Lazarus Group used compromised servers to host malware.
MITRE ATT&CK technique: T1608.001: Stage Capabilities- Upload Malware
For Operation Dream Job, Lazarus Group used multiple servers to host malicious tools.
MITRE ATT&CK technique: T1608.002: Stage Capabilities- Upload Tool
During Operation Dream Job, Lazarus Group executed a VBA written malicious macro after victims download malicious DOTM files; Lazarus Group also used Visual Basic macro code to extract a double Base64 encoded DLL implant.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
During Operation Dream Job, Lazarus Group uses HTTP and HTTPS to contact actor-controlled C2 servers.
MITRE ATT&CK technique: T1071.001: Application Layer Protocol- Web Protocols
During Operation Dream Job, Lazarus Group used file hosting services like DropBox and OneDrive.
MITRE ATT&CK technique: T1583.006: Acquire Infrastructure- Web Services
During Operation Dream Job, Lazarus Group launched malicious DLL files, created new folders, and renamed folders with the use of the Windows command shell.
MITRE ATT&CK technique: T1059.003: Command and Scripting Interpreter- Windows Command Shell
During Operation Dream Job, Lazarus Group used WMIC to executed a remote XSL script.
MITRE ATT&CK technique: T1047: Windows Management Instrumentation
During Operation Dream Job, Lazarus Group used a remote XSL script to download a Base64-encoded DLL custom downloader.
MITRE ATT&CK technique: T1220: XSL Script Processing
During Operation Dust Storm, attackers used VBS code to decode payloads.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
For Operation Dust Storm, the threat actors established domains as part of their operational infrastructure.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
During Operation Dust Storm, the threat actors used a watering hole attack on a popular software reseller to exploit the then-zero-day Internet Explorer vulnerability CVE-2014-0322.
MITRE ATT&CK technique: T1189: Drive-by Compromise
For Operation Dust Storm, the threat actors used dynamic DNS domains from a variety of free providers, including No-IP, Oray, and 3322.
MITRE ATT&CK technique: T1568: Dynamic Resolution
For Operation Dust Storm, the threat actors established email addresses to register domains for their operations.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
During Operation Dust Storm, the threat actors encoded some payloads with a single-byte XOR, both skipping the key itself and zeroing in an attempt to avoid exposing the key; other payloads were Base64-encoded.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File
During Operation Dust Storm, the threat actors exploited Adobe Flash vulnerability CVE-2011-0611, Microsoft Windows Help vulnerability CVE-2010-1885, and several Internet Explorer vulnerabilities, including CVE-2011-1255, CVE-2012-1889, and CVE-2014-0322.
MITRE ATT&CK technique: T1203: Exploitation for Client Execution
During Operation Dust Storm, the threat actors used JavaScript code.
MITRE ATT&CK technique: T1059.007: Command and Scripting Interpreter- JavaScript
During Operation Dust Storm, the threat actors relied on potential victims to open a malicious Microsoft Word document sent via email.
MITRE ATT&CK technique: T1204.002: User Execution- Malicious File
During Operation Dust Storm, the threat actors relied on a victim clicking on a malicious link sent via email.
MITRE ATT&CK technique: T1204.001: User Execution- Malicious Link
For Operation Dust Storm, the threat actors disguised some executables as JPG files.
MITRE ATT&CK technique: T1036: Masquerading
During Operation Dust Storm, the threat actors executed JavaScript code via `mshta.exe`.
MITRE ATT&CK technique: T1218.005: System Binary Proxy Execution- Mshta
During Operation Dust Storm, the threat actors deployed a file called `DeployJava.js` to fingerprint installed software on a victim system prior to exploit delivery.
MITRE ATT&CK technique: T1518: Software Discovery
For Operation Dust Storm, the threat actors used UPX to pack some payloads.
MITRE ATT&CK technique: T1027.002: Obfuscated Files or Information- Software Packing
During Operation Dust Storm, the threat actors sent spearphishing emails that contained a malicious Microsoft Word document.
MITRE ATT&CK technique: T1566.001: Phishing- Spearphishing Attachment
During Operation Dust Storm, the threat actors sent spearphishing emails containing a malicious link.
MITRE ATT&CK technique: T1566.002: Phishing- Spearphishing Link
During Operation Dust Storm, the threat actors used Visual Basic scripts.
MITRE ATT&CK technique: T1059.005: Command and Scripting Interpreter- Visual Basic
For Operation Ghost, APT29 used social media platforms to hide communications to C2 servers.
MITRE ATT&CK technique: T1102.002: Web Service- Bidirectional Communication
For Operation Ghost, APT29 used stolen administrator credentials for lateral movement on compromised networks.
MITRE ATT&CK technique: T1078.002: Valid Accounts- Domain Accounts
For Operation Ghost, APT29 registered domains for use in C2 including some crafted to appear as existing legitimate domains.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
For Operation Ghost, APT29 used new strains of malware including FatDuke, MiniDuke, RegDuke, and PolyglotDuke.
MITRE ATT&CK technique: T1587.001: Develop Capabilities- Malware
For Operation Ghost, APT29 registered Twitter accounts to host C2 nodes.
MITRE ATT&CK technique: T1585.001: Establish Accounts- Social Media Accounts
During Operation Ghost, APT29 used steganography to hide payloads inside valid images.
MITRE ATT&CK technique: T1027.003: Obfuscated Files or Information- Steganography
During Operation Ghost, APT29 used steganography to hide the communications between the implants and their C&C servers.
MITRE ATT&CK technique: T1001.002: Data Obfuscation- Steganography
During Operation Ghost, APT29 used WMI event subscriptions to establish persistence for malware.
MITRE ATT&CK technique: T1546.003: Event Triggered Execution- Windows Management Instrumentation Event Subscription
During Operation Honeybee, the threat actors uses zip to pack collected files before exfiltration.
MITRE ATT&CK technique: T1560.001: Archive Collected Data- Archive via Utility
During Operation Honeybee, the threat actors used the malicious NTWDBLIB.DLL and `cliconfig.exe` to bypass UAC protections.
MITRE ATT&CK technique: T1548.002: Abuse Elevation Control Mechanism- Bypass User Account Control
During Operation Honeybee, the threat actors deployed the MaoCheng dropper with a stolen Adobe Systems digital signature.
MITRE ATT&CK technique: T1553.002: Subvert Trust Controls- Code Signing
During Operation Honeybee, the threat actors collected data from compromised hosts.
MITRE ATT&CK technique: T1005: Data from Local System
During Operation Honeybee, malicious files were decoded prior to execution.
MITRE ATT&CK technique: T1140: Deobfuscate/Decode Files or Information
For Operation Honeybee, the threat actors stole a digital signature from Adobe Systems to use with their MaoCheng dropper.
MITRE ATT&CK technique: T1588.004: Obtain Capabilities- Digital Certificates
During Operation Honeybee, threat actors registered domains for C2.
MITRE ATT&CK technique: T1583.001: Acquire Infrastructure- Domains
During Operation Honeybee, attackers created email addresses to register for a free account for a control server used for the implants.
MITRE ATT&CK technique: T1585.002: Establish Accounts- Email Accounts
During Operation Honeybee, the threat actors used Base64 to encode files with a custom key.
MITRE ATT&CK technique: T1027.013: Obfuscated Files or Information- Encrypted/Encoded File