Trusted Design

Grabit and the RATs

概要

Not so long ago, Kaspersky clients in the United States approached Kaspersky researchers with a request to investigate a new type of malicious software that they were able to recover from their organizations’ servers. The malware calls itself Grabit and is distinctive because of its versatile behavior. Every sample we found was different in size and activity from the others but the internal name and other identifiers were disturbingly similar. The timestamp seems valid and close to the documented infection timeline. Our documentation points to a campaign that started somewhere in late February 2015 and ended in mid-March. As the development phase supposedly ended, malware started spreading from India, the United States and Israel to other countries around the globe.

Created: 2026-02-23

Indicators

類似Pulses

Aggressive Malware Pushers: Prolific Cyber Surfers Beware (score: 0.62)
Ramnit – in-depth analysis (score: 0.61)
Graftor malware on Metadefender.com (score: 0.59)
TrendLabs: Spam Campaign Delivers Cross-platform Remote Access Trojan Adwind (score: 0.59)
Exploring Bergard: Old Malware with New Tricks (score: 0.59)

このPulseに関連する脅威アクター (事実ベース)

Ember Bear

Score: 10.44

Matched TTPs:

T1491.002 - External Defacement
T1195 - Supply Chain Compromise
T1588.001 - Malware

MITREへのリンク →

Sandworm Team

Score: 17.63

Matched TTPs:

T1491.002 - External Defacement
T1587.001 - Malware
T1608.001 - Upload Malware
T1195 - Supply Chain Compromise
T1199 - Trusted Relationship
T1584.004 - Server

MITREへのリンク →

Kimsuky

Score: 19.41

Matched TTPs:

T1036.007 - Double File Extension
T1587.001 - Malware
T1007 - System Service Discovery
T1608.001 - Upload Malware
T1070.006 - Timestomp
T1036.004 - Masquerade Task or Service
T1587 - Develop Capabilities

MITREへのリンク →

Mustang Panda

Score: 15.08

Matched TTPs:

T1036.007 - Double File Extension
T1587.001 - Malware
T1608.001 - Upload Malware
T1070.006 - Timestomp
T1027.007 - Dynamic API Resolution

MITREへのリンク →

FIN13

Score: 7.12

Matched TTPs:

T1587.001 - Malware
T1036.004 - Masquerade Task or Service
T1090.001 - Internal Proxy

MITREへのリンク →

Moonstone Sleet

Score: 7.91

Matched TTPs:

T1587.001 - Malware
T1608.001 - Upload Malware
T1587 - Develop Capabilities

MITREへのリンク →

Indrik Spider

Score: 7.45

Matched TTPs:

T1587.001 - Malware
T1007 - System Service Discovery
T1584.004 - Server

MITREへのリンク →

Lazarus Group

Score: 19.42

Matched TTPs:

T1587.001 - Malware
T1070.006 - Timestomp
T1036.004 - Masquerade Task or Service
T1584.004 - Server
T1027.007 - Dynamic API Resolution
T1124 - System Time Discovery
T1090.001 - Internal Proxy

MITREへのリンク →

Contagious Interview

Score: 12.05

Matched TTPs:

T1587.001 - Malware
T1608.001 - Upload Malware
T1681 - Search Threat Vendor Data
T1587 - Develop Capabilities

MITREへのリンク →

OilRig

Score: 10.44

Matched TTPs:

T1587.001 - Malware
T1007 - System Service Discovery
T1608.001 - Upload Malware
T1195 - Supply Chain Compromise

MITREへのリンク →

UNC3886

Score: 16.12

Matched TTPs:

T1587.001 - Malware
T1070.006 - Timestomp
T1681 - Search Threat Vendor Data
T1588.001 - Malware
T1036.004 - Masquerade Task or Service
T1124 - System Time Discovery

MITREへのリンク →

LuminousMoth

Score: 9.97

Matched TTPs:

T1587.001 - Malware
T1608.001 - Upload Malware
T1588.001 - Malware
T1030 - Data Transfer Size Limits

MITREへのリンク →

APT29

Score: 7.59

Matched TTPs:

T1587.001 - Malware
T1070.006 - Timestomp
T1199 - Trusted Relationship

MITREへのリンク →

Play

Score: 5.53

Matched TTPs:

T1587.001 - Malware
T1030 - Data Transfer Size Limits

MITREへのリンク →

RedCurl

Score: 4.84

Matched TTPs:

T1587.001 - Malware
T1199 - Trusted Relationship

MITREへのリンク →

Turla

Score: 15.43

Matched TTPs:

T1587.001 - Malware
T1007 - System Service Discovery
T1588.001 - Malware
T1584.004 - Server
T1124 - System Time Discovery
T1090.001 - Internal Proxy

MITREへのリンク →

Ke3chang

Score: 4.62

Matched TTPs:

T1587.001 - Malware
T1007 - System Service Discovery

MITREへのリンク →

TeamTNT

Score: 6.59

Matched TTPs:

T1587.001 - Malware
T1007 - System Service Discovery
T1608.001 - Upload Malware

MITREへのリンク →

FIN7

Score: 8.76

Matched TTPs:

T1587.001 - Malware
T1608.001 - Upload Malware
T1036.004 - Masquerade Task or Service
T1124 - System Time Discovery

MITREへのリンク →

BRONZE BUTLER

Score: 5.12

Matched TTPs:

T1007 - System Service Discovery
T1124 - System Time Discovery

MITREへのリンク →

Aquatic Panda

Score: 7.08

Matched TTPs:

T1007 - System Service Discovery
T1588.001 - Malware
T1036.004 - Masquerade Task or Service

MITREへのリンク →

Chimera

Score: 7.86

Matched TTPs:

T1007 - System Service Discovery
T1070.006 - Timestomp
T1124 - System Time Discovery

MITREへのリンク →

Earth Lusca

Score: 9.79

Matched TTPs:

T1007 - System Service Discovery
T1608.001 - Upload Malware
T1588.001 - Malware
T1584.004 - Server

MITREへのリンク →

Volt Typhoon

Score: 10.88

Matched TTPs:

T1007 - System Service Discovery
T1584.004 - Server
T1124 - System Time Discovery
T1090.001 - Internal Proxy

MITREへのリンク →

APT1

Score: 4.98

Matched TTPs:

T1007 - System Service Discovery
T1588.001 - Malware

MITREへのリンク →

TA2541

Score: 4.43

Matched TTPs:

T1608.001 - Upload Malware
T1588.001 - Malware

MITREへのリンク →

Mustard Tempest

Score: 6.51

Matched TTPs:

T1608.001 - Upload Malware
T1608.006 - SEO Poisoning

MITREへのリンク →

LazyScripter

Score: 4.43

Matched TTPs:

T1608.001 - Upload Malware
T1588.001 - Malware

MITREへのリンク →

Gamaredon Group

Score: 5.12

Matched TTPs:

T1608.001 - Upload Malware
T1221 - Template Injection

MITREへのリンク →

Threat Group-3390

Score: 12.29

Matched TTPs:

T1608.001 - Upload Malware
T1608.002 - Upload Tool
T1199 - Trusted Relationship
T1030 - Data Transfer Size Limits

MITREへのリンク →

TA505

Score: 4.43

Matched TTPs:

T1608.001 - Upload Malware
T1588.001 - Malware

MITREへのリンク →

BITTER

Score: 4.07

Matched TTPs:

T1608.001 - Upload Malware
T1036.004 - Masquerade Task or Service

MITREへのリンク →

APT32

Score: 6.81

Matched TTPs:

T1608.001 - Upload Malware
T1070.006 - Timestomp
T1036.004 - Masquerade Task or Service

MITREへのリンク →

APT28

Score: 16.22

Matched TTPs:

T1070.006 - Timestomp
T1199 - Trusted Relationship
T1030 - Data Transfer Size Limits
T1221 - Template Injection
T1211 - Exploitation for Defense Evasion

MITREへのリンク →

Medusa Group

Score: 13.21

Matched TTPs:

T1608.002 - Upload Tool
T1650 - Acquire Access
T1218.014 - MMC

MITREへのリンク →

LAPSUS$

Score: 9.74

Matched TTPs:

T1588.001 - Malware
T1213.001 - Confluence
T1199 - Trusted Relationship

MITREへのリンク →

BackdoorDiplomacy

Score: 4.55

Matched TTPs:

T1588.001 - Malware
T1036.004 - Masquerade Task or Service

MITREへのリンク →

ZIRCONIUM

Score: 4.69

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1124 - System Time Discovery

MITREへのリンク →

Higaisa

Score: 7.62

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1124 - System Time Discovery
T1090.001 - Internal Proxy

MITREへのリンク →

APT41

Score: 5.53

Matched TTPs:

T1036.004 - Masquerade Task or Service
T1030 - Data Transfer Size Limits

MITREへのリンク →

APT37

Score: 4.13

Matched TTPs:

T1036.001 - Invalid Code Signature

MITREへのリンク →

Windshift

Score: 4.13

Matched TTPs:

T1036.001 - Invalid Code Signature

MITREへのリンク →

Dragonfly

Score: 5.98

Matched TTPs:

T1221 - Template Injection
T1584.004 - Server

MITREへのリンク →

Confucius

Score: 3.15

Matched TTPs:

T1221 - Template Injection

MITREへのリンク →

Tropic Trooper

Score: 3.15

Matched TTPs:

T1221 - Template Injection

MITREへのリンク →

Inception

Score: 3.15

Matched TTPs:

T1221 - Template Injection

MITREへのリンク →

DarkHydrus

Score: 3.15

Matched TTPs:

T1221 - Template Injection

MITREへのリンク →

Equation

Score: 4.13

Matched TTPs:

T1564.005 - Hidden File System

MITREへのリンク →

Strider

Score: 7.06

Matched TTPs:

T1564.005 - Hidden File System
T1090.001 - Internal Proxy

MITREへのリンク →

Velvet Ant

Score: 7.06

Matched TTPs:

T1090.001 - Internal Proxy
T1211 - Exploitation for Defense Evasion

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.80

Matched TTPs:

T1587.001 - Malware
T1036.007 - Double File Extension
T1587 - Develop Capabilities
T1036.004 - Masquerade Task or Service
T1070.006 - Timestomp
T1608.001 - Upload Malware
T1007 - System Service Discovery

MITREへのリンク →

Lazarus Group

Score: 0.80

Matched TTPs:

T1587.001 - Malware
T1027.007 - Dynamic API Resolution
T1584.004 - Server
T1036.004 - Masquerade Task or Service
T1070.006 - Timestomp
T1124 - System Time Discovery
T1090.001 - Internal Proxy

MITREへのリンク →

Sandworm Team

Score: 0.76

Matched TTPs:

T1199 - Trusted Relationship
T1195 - Supply Chain Compromise
T1584.004 - Server
T1587.001 - Malware
T1608.001 - Upload Malware
T1491.002 - External Defacement

MITREへのリンク →

APT28

Score: 0.72

Matched TTPs:

T1199 - Trusted Relationship
T1221 - Template Injection
T1030 - Data Transfer Size Limits
T1211 - Exploitation for Defense Evasion
T1070.006 - Timestomp

MITREへのリンク →

UNC3886

Score: 0.72

Matched TTPs:

T1588.001 - Malware
T1587.001 - Malware
T1681 - Search Threat Vendor Data
T1036.004 - Masquerade Task or Service
T1070.006 - Timestomp
T1124 - System Time Discovery

MITREへのリンク →

Turla

Score: 0.71

Matched TTPs:

T1588.001 - Malware
T1090.001 - Internal Proxy
T1584.004 - Server
T1587.001 - Malware
T1124 - System Time Discovery
T1007 - System Service Discovery

MITREへのリンク →

Mustang Panda

Score: 0.63

Matched TTPs:

T1587.001 - Malware
T1027.007 - Dynamic API Resolution
T1036.007 - Double File Extension
T1070.006 - Timestomp
T1608.001 - Upload Malware

MITREへのリンク →

Medusa Group

Score: 0.62

Matched TTPs:

T1608.002 - Upload Tool
T1650 - Acquire Access
T1218.014 - MMC

MITREへのリンク →

Threat Group-3390

Score: 0.57

Matched TTPs:

T1199 - Trusted Relationship
T1608.002 - Upload Tool
T1608.001 - Upload Malware
T1030 - Data Transfer Size Limits

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る