rpt-apt29-hammertoss-stealthy-tactics-define-en.pdf
Excerpt
CONTENTS
HAMMERTOSS 3
APT29 5
Introducing HAMMERTOSS 6
Five Stages of HAMMERTOSS 6
Stage 1: The Communication Process Begins with Twitter 7
Figure 1: HAMMERTOSS calls out to a Twitter handle 7
Stage 2: Tweeting a URL, Minimum File Size of an Image, and Part of an Encryption Key 8 Figure 2: Learning the URL, image size, and encryption key 8 Figure 3: Twitter page for d3109c83e07dd5d7fe032dc80c581d08 9 Stage 3: Visiting GitHub to Download an Image 10
Figure 4: The active Twitter account in our sample conta…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Mandiant (Google) on services.google.com.
Mentioned in the excerpt
More from Mandiant (Google)32
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
- ARMORY CASTLE Exploits BeyondTrustMandiant (Google) · Published 15 Oct
- Mandiant Cybersecurity ConsultingMandiant (Google) · Added 18 Oct
- Why Are You Texting Me? UNC3944 Leverages SMS Phishing Campaigns for SIM Swapping, Ransomware, Extortion, and NotorietyMandiant (Google) · Published 14 Sep 2023
On the same topics
- Retrohunting APT37: North Korean APT used VBA self decode technique to inject RokRatMalwarebytes · Published 5 Jan 2021
- Kazuar (Malware Family)Malpedia · Added 18 Oct
- Chinese Nation-State Hackers Target U.S in Operation TradeSecret, Report Claimseweek.com · Published 6 Apr 2017
- Taiwan High-Tech Ecosystem Targeted by Foreign APT Group:Medium · Published 10 Jun 2022
