Research reports

Added Mon 6 Apr

1. MITRE ATT&CKWeb page

   Encrypted Channel, Technique T1573 - Enterprise

   APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…

   State-sponsoredMalwareBotnets and DDoS

   MITRE ATT&CK
2. MITRE ATT&CKWeb page

   Encrypted Channel, Technique T1573 - Enterprise

   APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…

   State-sponsoredMalwareBotnets and DDoS

   MITRE ATT&CK
3. MITRE ATT&CKWeb page

   Software Discovery: Security Software Discovery, Sub-technique T1518.001 - Enterprise

   ABK has the ability to identify the installed anti-virus product on the compromised host.[1] S1028 Action RAT Action RAT can identify AV products on an infected host using the following command: cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2…

   State-sponsoredMalware

   MITRE ATT&CK
4. MITRE ATT&CKWeb page

   APT19, Codoso, C0d0so0, Codoso Team, Sunshop Group, Group G0073

   APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.[1][4] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder An APT19 HTTP malware variant establishes…

   State-sponsoredMalware

   MITRE ATT&CK