Research reports

Added Mon 6 Apr

1. MITRE ATT&CKWeb page

   Encrypted Channel, Technique T1573 - Enterprise

   APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…

   State-sponsoredMalwareBotnets and DDoS

   MITRE ATT&CK
2. MITRE ATT&CKWeb page

   Encrypted Channel, Technique T1573 - Enterprise

   APT29 has used multiple layers of encryption within malware to protect C2 communication.[1] G1002 BITTER BITTER has encrypted their C2 communications.[2] S0631 Chaes Chaes has used encryption for its C2 channel.[3] S0498 Cryptoistic Cryptoistic can engage in…

   State-sponsoredMalwareBotnets and DDoS

   MITRE ATT&CK
3. MITRE ATT&CKWeb page

   Server Software Component: Web Shell, Sub-technique T1505.003 - Enterprise

   During the 2022 Ukraine Electric Power Attack, Sandworm Team deployed the Neo-REGEORG webshell on an internet-facing server. [3] G1030 Agrius Agrius typically deploys a variant of the ASPXSpy web shell following initial access via exploitation.[4] G0007 APT28…

   State-sponsoredVulnerabilities

   MITRE ATT&CK
4. MITRE ATT&CKWeb page

   Software Discovery: Security Software Discovery, Sub-technique T1518.001 - Enterprise

   ABK has the ability to identify the installed anti-virus product on the compromised host.[1] S1028 Action RAT Action RAT can identify AV products on an infected host using the following command: cmd.exe WMIC /Node:localhost /Namespace:\\root\SecurityCenter2…

   State-sponsoredMalware

   MITRE ATT&CK
5. MITRE ATT&CKWeb page

   Modify Registry, Technique T1112 - Enterprise

   During the 2015 Ukraine Electric Power Attack, Sandworm Team modified in-registry Internet settings to lower internet security before launching rundll32.exe , which in-turn launches the malware and communicates with C2 servers over the Internet. [11]. S0677…

   State-sponsored

   MITRE ATT&CK
6. MITRE ATT&CKWeb page

   APT19, Codoso, C0d0so0, Codoso Team, Sunshop Group, Group G0073

   APT19 used HTTP for C2 communications. APT19 also used an HTTP malware variant to communicate over HTTP for C2.[1][4] Enterprise T1547 .001 Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder An APT19 HTTP malware variant establishes…

   State-sponsoredMalware

   MITRE ATT&CK