Trusted Design

Financial Threat Group Targets Volume Boot Record

概要

Nemesis, the malware ecosystem used by FIN1, includes comprehensive backdoors that support a variety of network protocols and communication channels for command and control (CnC). It provides a robust set of capabilities, including: file transfer, screen capture, keystroke logging, process injection, process manipulation, and task scheduling. The threat group continually updated the Nemesis malware during their ongoing access to the victim environment, deploying several different variants of the same tools and adding functionality between iterations. In early 2015, FIN1 updated their toolset to include a utility that modifies the legitimate system Volume Boot Record (VBR) and hijacks the system boot process to begin loading Nemesis components before the Windows operating system code. We refer to this utility as BOOTRASH.

Created: 2026-02-23

Indicators

類似Pulses

このPulseに関連する脅威アクター (事実ベース)

APT3

Score: 18.14
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1074.001 - Local Data Staging
  • T1543.003 - Windows Service
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1546.008 - Accessibility Features
  • T1057 - Process Discovery
  • T1041 - Exfiltration Over C2 Channel
  • T1203 - Exploitation for Client Execution
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Cobalt Group

Score: 24.42
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1543.003 - Windows Service
  • T1219 - Remote Access Tools
  • T1055 - Process Injection
  • T1218.003 - CMSTP
  • T1588.002 - Tool
  • T1218.010 - Regsvr32
  • T1195.002 - Compromise Software Supply Chain
  • T1203 - Exploitation for Client Execution
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Silence

Score: 16.63
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1113 - Screen Capture
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1106 - Native API
  • T1055 - Process Injection
  • T1112 - Modify Registry
  • T1588.002 - Tool
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
MITREへのリンク →

Chimera

Score: 37.82
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1007 - System Service Discovery
  • T1106 - Native API
  • T1021.006 - Windows Remote Management
  • T1057 - Process Discovery
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1039 - Data from Network Shared Drive
  • T1570 - Lateral Tool Transfer
  • T1012 - Query Registry
  • T1556.001 - Domain Controller Authentication
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
  • T1680 - Local Storage Discovery
MITREへのリンク →

Patchwork

Score: 21.01
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1112 - Modify Registry
  • T1027.001 - Binary Padding
  • T1588.002 - Tool
  • T1203 - Exploitation for Client Execution
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1680 - Local Storage Discovery
MITREへのリンク →

Daggerfly

Score: 11.66
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1082 - System Information Discovery
  • T1195.002 - Compromise Software Supply Chain
  • T1036.003 - Rename Legitimate Utilities
  • T1012 - Query Registry
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

FIN7

Score: 57.01
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1113 - Screen Capture
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1543.003 - Windows Service
  • T1082 - System Information Discovery
  • T1091 - Replication Through Removable Media
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1219 - Remote Access Tools
  • T1546.011 - Application Shimming
  • T1620 - Reflective Code Loading
  • T1674 - Input Injection
  • T1583.006 - Web Services
  • T1057 - Process Discovery
  • T1497.002 - User Activity Based Checks
  • T1210 - Exploitation of Remote Services
  • T1588.002 - Tool
  • T1195.002 - Compromise Software Supply Chain
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
  • T1008 - Fallback Channels
MITREへのリンク →

TA2541

Score: 25.77
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1082 - System Information Discovery
  • T1608.001 - Upload Malware
  • T1055 - Process Injection
  • T1588.001 - Malware
  • T1568 - Dynamic Resolution
  • T1583.006 - Web Services
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1518.001 - Security Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1027.015 - Compression
MITREへのリンク →

GALLIUM

Score: 16.70
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1074.001 - Local Data Staging
  • T1005 - Data from Local System
  • T1190 - Exploit Public-Facing Application
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1036.003 - Rename Legitimate Utilities
  • T1570 - Lateral Tool Transfer
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Sandworm Team

Score: 51.09
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1561.002 - Disk Structure Wipe
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1082 - System Information Discovery
  • T1106 - Native API
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1190 - Exploit Public-Facing Application
  • T1219 - Remote Access Tools
  • T1036 - Masquerading
  • T1584.005 - Botnet
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1195.002 - Compromise Software Supply Chain
  • T1203 - Exploitation for Client Execution
  • T1570 - Lateral Tool Transfer
  • T1499 - Endpoint Denial of Service
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1490 - Inhibit System Recovery
MITREへのリンク →

BlackByte

Score: 43.53
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1543.003 - Windows Service
  • T1082 - System Information Discovery
  • T1140 - Deobfuscate/Decode Files or Information
  • T1562 - Impair Defenses
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1219 - Remote Access Tools
  • T1055 - Process Injection
  • T1112 - Modify Registry
  • T1041 - Exfiltration Over C2 Channel
  • T1562.001 - Disable or Modify Tools
  • T1570 - Lateral Tool Transfer
  • T1614.001 - System Language Discovery
  • T1012 - Query Registry
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
  • T1490 - Inhibit System Recovery
MITREへのリンク →

HEXANE

Score: 14.14
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1082 - System Information Discovery
  • T1608.001 - Upload Malware
  • T1010 - Application Window Discovery
  • T1057 - Process Discovery
  • T1588.002 - Tool
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Mustang Panda

Score: 61.42
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1082 - System Information Discovery
  • T1106 - Native API
  • T1091 - Replication Through Removable Media
  • T1140 - Deobfuscate/Decode Files or Information
  • T1608.001 - Upload Malware
  • T1176.002 - IDE Extensions
  • T1654 - Log Enumeration
  • T1583.006 - Web Services
  • T1057 - Process Discovery
  • T1041 - Exfiltration Over C2 Channel
  • T1678 - Delay Execution
  • T1588.002 - Tool
  • T1203 - Exploitation for Client Execution
  • T1001.003 - Protocol or Service Impersonation
  • T1219.002 - Remote Desktop Software
  • T1070.004 - File Deletion
  • T1518 - Software Discovery
  • T1622 - Debugger Evasion
  • T1105 - Ingress Tool Transfer
  • T1027.007 - Dynamic API Resolution
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

Magic Hound

Score: 32.99
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1113 - Screen Capture
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1562 - Impair Defenses
  • T1190 - Exploit Public-Facing Application
  • T1112 - Modify Registry
  • T1583.006 - Web Services
  • T1057 - Process Discovery
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1573 - Encrypted Channel
  • T1570 - Lateral Tool Transfer
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

FIN13

Score: 27.90
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1036 - Masquerading
  • T1021.006 - Windows Remote Management
  • T1657 - Financial Theft
  • T1588.002 - Tool
  • T1105 - Ingress Tool Transfer
  • T1556 - Modify Authentication Process
MITREへのリンク →

ToddyCat

Score: 17.88
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1106 - Native API
  • T1005 - Data from Local System
  • T1190 - Exploit Public-Facing Application
  • T1057 - Process Discovery
  • T1518.001 - Security Software Discovery
  • T1680 - Local Storage Discovery
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Blue Mockingbird

Score: 20.87
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1543.003 - Windows Service
  • T1082 - System Information Discovery
  • T1190 - Exploit Public-Facing Application
  • T1112 - Modify Registry
  • T1588.002 - Tool
  • T1218.010 - Regsvr32
  • T1569.002 - Service Execution
  • T1574.012 - COR_PROFILER
MITREへのリンク →

Molerats

Score: 11.52
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1218.007 - Msiexec
  • T1140 - Deobfuscate/Decode Files or Information
  • T1057 - Process Discovery
  • T1105 - Ingress Tool Transfer
  • T1027.015 - Compression
MITREへのリンク →

Storm-0501

Score: 25.86
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1082 - System Information Discovery
  • T1190 - Exploit Public-Facing Application
  • T1021.006 - Windows Remote Management
  • T1657 - Financial Theft
  • T1057 - Process Discovery
  • T1218.010 - Regsvr32
  • T1614.001 - System Language Discovery
  • T1518.001 - Security Software Discovery
  • T1219.002 - Remote Desktop Software
  • T1490 - Inhibit System Recovery
MITREへのリンク →

APT29

Score: 39.56
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1005 - Data from Local System
  • T1190 - Exploit Public-Facing Application
  • T1027.001 - Binary Padding
  • T1546.008 - Accessibility Features
  • T1568 - Dynamic Resolution
  • T1583.006 - Web Services
  • T1588.002 - Tool
  • T1573 - Encrypted Channel
  • T1203 - Exploitation for Client Execution
  • T1562.008 - Disable or Modify Cloud Logs
  • T1070.004 - File Deletion
  • T1037.004 - RC Scripts
  • T1105 - Ingress Tool Transfer
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

APT39

Score: 32.65
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1113 - Screen Capture
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1547.009 - Shortcut Modification
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1056 - Input Capture
  • T1012 - Query Registry
  • T1546.010 - AppInit DLLs
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
MITREへのリンク →

FIN8

Score: 13.45
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1082 - System Information Discovery
  • T1112 - Modify Registry
  • T1588.002 - Tool
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

Wizard Spider

Score: 54.51
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1074.001 - Local Data Staging
  • T1543.003 - Windows Service
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1055 - Process Injection
  • T1518.002 - Backup Software Discovery
  • T1112 - Modify Registry
  • T1021.006 - Windows Remote Management
  • T1547.004 - Winlogon Helper DLL
  • T1552.006 - Group Policy Preferences
  • T1041 - Exfiltration Over C2 Channel
  • T1210 - Exploitation of Remote Services
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1570 - Lateral Tool Transfer
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
  • T1055.001 - Dynamic-link Library Injection
  • T1490 - Inhibit System Recovery
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

Higaisa

Score: 24.13
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1082 - System Information Discovery
  • T1106 - Native API
  • T1140 - Deobfuscate/Decode Files or Information
  • T1027.001 - Binary Padding
  • T1057 - Process Discovery
  • T1041 - Exfiltration Over C2 Channel
  • T1203 - Exploitation for Client Execution
  • T1001.003 - Protocol or Service Impersonation
  • T1680 - Local Storage Discovery
  • T1027.015 - Compression
MITREへのリンク →

APT41

Score: 42.40
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1014 - Rootkit
  • T1542.003 - Bootkit
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1543.003 - Windows Service
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1190 - Exploit Public-Facing Application
  • T1055 - Process Injection
  • T1112 - Modify Registry
  • T1546.008 - Accessibility Features
  • T1588.002 - Tool
  • T1195.002 - Compromise Software Supply Chain
  • T1203 - Exploitation for Client Execution
  • T1570 - Lateral Tool Transfer
  • T1012 - Query Registry
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
  • T1008 - Fallback Channels
MITREへのリンク →

Rancor

Score: 5.29
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1218.007 - Msiexec
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Earth Lusca

Score: 27.82
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1543.003 - Windows Service
  • T1007 - System Service Discovery
  • T1140 - Deobfuscate/Decode Files or Information
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1112 - Modify Registry
  • T1588.001 - Malware
  • T1583.006 - Web Services
  • T1057 - Process Discovery
  • T1210 - Exploitation of Remote Services
  • T1588.002 - Tool
  • T1027.003 - Steganography
MITREへのリンク →

Ember Bear

Score: 33.67
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1561.002 - Disk Structure Wipe
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1005 - Data from Local System
  • T1195 - Supply Chain Compromise
  • T1190 - Exploit Public-Facing Application
  • T1036 - Masquerading
  • T1112 - Modify Registry
  • T1588.001 - Malware
  • T1654 - Log Enumeration
  • T1210 - Exploitation of Remote Services
  • T1562.001 - Disable or Modify Tools
  • T1203 - Exploitation for Client Execution
  • T1570 - Lateral Tool Transfer
  • T1070.004 - File Deletion
MITREへのリンク →

Machete

Score: 5.65
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1218.007 - Msiexec
MITREへのリンク →

APT42

Score: 22.33
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1113 - Screen Capture
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1547 - Boot or Logon Autostart Execution
  • T1082 - System Information Discovery
  • T1608.001 - Upload Malware
  • T1112 - Modify Registry
  • T1588.002 - Tool
  • T1056 - Input Capture
  • T1518.001 - Security Software Discovery
MITREへのリンク →

FIN10

Score: 5.69
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1588.002 - Tool
  • T1570 - Lateral Tool Transfer
  • T1070.004 - File Deletion
MITREへのリンク →

Naikon

Score: 5.80
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1518.001 - Security Software Discovery
MITREへのリンク →

RedCurl

Score: 19.79
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1082 - System Information Discovery
  • T1202 - Indirect Command Execution
  • T1005 - Data from Local System
  • T1056.002 - GUI Input Capture
  • T1039 - Data from Network Shared Drive
  • T1070.004 - File Deletion
MITREへのリンク →

Moonstone Sleet

Score: 20.54
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1587.001 - Malware
  • T1082 - System Information Discovery
  • T1140 - Deobfuscate/Decode Files or Information
  • T1608.001 - Upload Malware
  • T1195.002 - Compromise Software Supply Chain
  • T1105 - Ingress Tool Transfer
  • T1587 - Develop Capabilities
  • T1569.002 - Service Execution
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

APT32

Score: 44.16
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1543.003 - Windows Service
  • T1082 - System Information Discovery
  • T1608.001 - Upload Malware
  • T1036 - Masquerading
  • T1055 - Process Injection
  • T1112 - Modify Registry
  • T1583.006 - Web Services
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1218.010 - Regsvr32
  • T1036.003 - Rename Legitimate Utilities
  • T1203 - Exploitation for Client Execution
  • T1570 - Lateral Tool Transfer
  • T1012 - Query Registry
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
  • T1564.004 - NTFS File Attributes
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

Fox Kitten

Score: 17.35
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1005 - Data from Local System
  • T1190 - Exploit Public-Facing Application
  • T1546.008 - Accessibility Features
  • T1210 - Exploitation of Remote Services
  • T1039 - Data from Network Shared Drive
  • T1012 - Query Registry
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

APT33

Score: 11.22
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1552.006 - Group Policy Preferences
  • T1588.002 - Tool
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

OilRig

Score: 53.41
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1113 - Screen Capture
  • T1025 - Data from Removable Media
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1543.003 - Windows Service
  • T1497.001 - System Checks
  • T1007 - System Service Discovery
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1219 - Remote Access Tools
  • T1036 - Masquerading
  • T1112 - Modify Registry
  • T1057 - Process Discovery
  • T1588.002 - Tool
  • T1203 - Exploitation for Client Execution
  • T1012 - Query Registry
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1008 - Fallback Channels
  • T1566.003 - Spearphishing via Service
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

APT38

Score: 47.28
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1561.002 - Disk Structure Wipe
  • T1543.003 - Windows Service
  • T1565.003 - Runtime Data Manipulation
  • T1082 - System Information Discovery
  • T1218.007 - Msiexec
  • T1106 - Native API
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1055 - Process Injection
  • T1480.002 - Mutual Exclusion
  • T1112 - Modify Registry
  • T1057 - Process Discovery
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1036.003 - Rename Legitimate Utilities
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
  • T1529 - System Shutdown/Reboot
MITREへのリンク →

menuPass

Score: 26.83
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1106 - Native API
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1036 - Masquerading
  • T1210 - Exploitation of Remote Services
  • T1588.002 - Tool
  • T1039 - Data from Network Shared Drive
  • T1036.003 - Rename Legitimate Utilities
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

FIN6

Score: 15.91
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1005 - Data from Local System
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1070.004 - File Deletion
  • T1569.002 - Service Execution
  • T1566.003 - Spearphishing via Service
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

LuminousMoth

Score: 18.80
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1091 - Replication Through Removable Media
  • T1005 - Data from Local System
  • T1608.001 - Upload Malware
  • T1112 - Modify Registry
  • T1588.001 - Malware
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Lazarus Group

Score: 95.04
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1561.002 - Disk Structure Wipe
  • T1542.003 - Bootkit
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1543.003 - Windows Service
  • T1082 - System Information Discovery
  • T1106 - Native API
  • T1202 - Indirect Command Execution
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1218 - System Binary Proxy Execution
  • T1620 - Reflective Code Loading
  • T1547.009 - Shortcut Modification
  • T1010 - Application Window Discovery
  • T1583.006 - Web Services
  • T1057 - Process Discovery
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1574.013 - KernelCallbackTable
  • T1562.001 - Disable or Modify Tools
  • T1036.003 - Rename Legitimate Utilities
  • T1203 - Exploitation for Client Execution
  • T1001.003 - Protocol or Service Impersonation
  • T1012 - Query Registry
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1027.007 - Dynamic API Resolution
  • T1008 - Fallback Channels
  • T1680 - Local Storage Discovery
  • T1055.001 - Dynamic-link Library Injection
  • T1566.003 - Spearphishing via Service
  • T1561.001 - Disk Content Wipe
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
  • T1529 - System Shutdown/Reboot
MITREへのリンク →

BRONZE BUTLER

Score: 30.52
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1113 - Screen Capture
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1007 - System Service Discovery
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1036 - Masquerading
  • T1027.001 - Binary Padding
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1039 - Data from Network Shared Drive
  • T1203 - Exploitation for Client Execution
  • T1027.003 - Steganography
  • T1070.004 - File Deletion
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Winter Vivern

Score: 12.69
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1113 - Screen Capture
  • T1082 - System Information Discovery
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1036 - Masquerading
  • T1041 - Exfiltration Over C2 Channel
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Dragonfly

Score: 22.57
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1113 - Screen Capture
  • T1074.001 - Local Data Staging
  • T1005 - Data from Local System
  • T1190 - Exploit Public-Facing Application
  • T1112 - Modify Registry
  • T1210 - Exploitation of Remote Services
  • T1588.002 - Tool
  • T1195.002 - Compromise Software Supply Chain
  • T1203 - Exploitation for Client Execution
  • T1012 - Query Registry
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

MuddyWater

Score: 43.52
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1113 - Screen Capture
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1082 - System Information Discovery
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1219 - Remote Access Tools
  • T1218.003 - CMSTP
  • T1583.006 - Web Services
  • T1057 - Process Discovery
  • T1041 - Exfiltration Over C2 Channel
  • T1210 - Exploitation of Remote Services
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1203 - Exploitation for Client Execution
  • T1027.003 - Steganography
  • T1027.004 - Compile After Delivery
  • T1518.001 - Security Software Discovery
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Gamaredon Group

Score: 64.34
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1113 - Screen Capture
  • T1025 - Data from Removable Media
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1497.001 - System Checks
  • T1082 - System Information Discovery
  • T1106 - Native API
  • T1091 - Replication Through Removable Media
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1608.001 - Upload Malware
  • T1055 - Process Injection
  • T1620 - Reflective Code Loading
  • T1112 - Modify Registry
  • T1568 - Dynamic Resolution
  • T1583.006 - Web Services
  • T1057 - Process Discovery
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1039 - Data from Network Shared Drive
  • T1012 - Query Registry
  • T1027.004 - Compile After Delivery
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1561.001 - Disk Content Wipe
  • T1027.015 - Compression
MITREへのリンク →

Kimsuky

Score: 61.02
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1113 - Screen Capture
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1543.003 - Windows Service
  • T1007 - System Service Discovery
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1055 - Process Injection
  • T1620 - Reflective Code Loading
  • T1112 - Modify Registry
  • T1027.001 - Binary Padding
  • T1657 - Financial Theft
  • T1583.006 - Web Services
  • T1057 - Process Discovery
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1218.010 - Regsvr32
  • T1012 - Query Registry
  • T1518.001 - Security Software Discovery
  • T1219.002 - Remote Desktop Software
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1587 - Develop Capabilities
  • T1680 - Local Storage Discovery
MITREへのリンク →

Stealth Falcon

Score: 11.14
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1047 - Windows Management Instrumentation
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1057 - Process Discovery
  • T1041 - Exfiltration Over C2 Channel
  • T1012 - Query Registry
MITREへのリンク →

BITTER

Score: 13.22
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1608.001 - Upload Malware
  • T1568 - Dynamic Resolution
  • T1588.002 - Tool
  • T1573 - Encrypted Channel
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Confucius

Score: 10.31
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1583.006 - Web Services
  • T1041 - Exfiltration Over C2 Channel
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1680 - Local Storage Discovery
MITREへのリンク →

APT37

Score: 22.50
Matched TTPs:
  • T1053.005 - Scheduled Task
  • T1561.002 - Disk Structure Wipe
  • T1082 - System Information Discovery
  • T1106 - Native API
  • T1005 - Data from Local System
  • T1055 - Process Injection
  • T1057 - Process Discovery
  • T1203 - Exploitation for Client Execution
  • T1027.003 - Steganography
  • T1105 - Ingress Tool Transfer
  • T1529 - System Shutdown/Reboot
MITREへのリンク →

Cinnamon Tempest

Score: 10.66
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1543.003 - Windows Service
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1657 - Financial Theft
  • T1588.002 - Tool
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Medusa Group

Score: 50.37
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1652 - Device Driver Discovery
  • T1543.003 - Windows Service
  • T1082 - System Information Discovery
  • T1106 - Native API
  • T1190 - Exploit Public-Facing Application
  • T1219 - Remote Access Tools
  • T1608.002 - Upload Tool
  • T1112 - Modify Registry
  • T1657 - Financial Theft
  • T1583.006 - Web Services
  • T1057 - Process Discovery
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1570 - Lateral Tool Transfer
  • T1518.001 - Security Software Discovery
  • T1650 - Acquire Access
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
  • T1490 - Inhibit System Recovery
  • T1529 - System Shutdown/Reboot
MITREへのリンク →

INC Ransom

Score: 18.70
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1190 - Exploit Public-Facing Application
  • T1219 - Remote Access Tools
  • T1657 - Financial Theft
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1570 - Lateral Tool Transfer
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
MITREへのリンク →

Leviathan

Score: 29.24
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1074.001 - Local Data Staging
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1547.009 - Shortcut Modification
  • T1027.001 - Binary Padding
  • T1041 - Exfiltration Over C2 Channel
  • T1218.010 - Regsvr32
  • T1203 - Exploitation for Client Execution
  • T1027.003 - Steganography
  • T1105 - Ingress Tool Transfer
  • T1055.001 - Dynamic-link Library Injection
  • T1027.015 - Compression
MITREへのリンク →

Velvet Ant

Score: 19.55
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1055 - Process Injection
  • T1562.001 - Disable or Modify Tools
  • T1570 - Lateral Tool Transfer
  • T1037.004 - RC Scripts
  • T1569.002 - Service Execution
  • T1211 - Exploitation for Defense Evasion
MITREへのリンク →

Volt Typhoon

Score: 52.89
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1113 - Screen Capture
  • T1006 - Direct Volume Access
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1497.001 - System Checks
  • T1007 - System Service Discovery
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1218 - System Binary Proxy Execution
  • T1010 - Application Window Discovery
  • T1112 - Modify Registry
  • T1584.005 - Botnet
  • T1654 - Log Enumeration
  • T1057 - Process Discovery
  • T1588.002 - Tool
  • T1570 - Lateral Tool Transfer
  • T1012 - Query Registry
  • T1070.004 - File Deletion
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1680 - Local Storage Discovery
MITREへのリンク →

Lotus Blossom

Score: 10.29
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1074.001 - Local Data Staging
  • T1543.003 - Windows Service
  • T1112 - Modify Registry
  • T1588.002 - Tool
  • T1012 - Query Registry
MITREへのリンク →

Indrik Spider

Score: 15.84
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1007 - System Service Discovery
  • T1112 - Modify Registry
  • T1562.001 - Disable or Modify Tools
  • T1012 - Query Registry
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Aquatic Panda

Score: 24.22
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1543.003 - Windows Service
  • T1007 - System Service Discovery
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1112 - Modify Registry
  • T1588.001 - Malware
  • T1654 - Log Enumeration
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Windshift

Score: 14.40
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1082 - System Information Discovery
  • T1036 - Masquerading
  • T1057 - Process Discovery
  • T1518.001 - Security Software Discovery
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Deep Panda

Score: 9.09
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1546.008 - Accessibility Features
  • T1057 - Process Discovery
  • T1218.010 - Regsvr32
MITREへのリンク →

Threat Group-3390

Score: 36.80
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1074.001 - Local Data Staging
  • T1543.003 - Windows Service
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1608.002 - Upload Tool
  • T1112 - Modify Registry
  • T1021.006 - Windows Remote Management
  • T1210 - Exploitation of Remote Services
  • T1588.002 - Tool
  • T1195.002 - Compromise Software Supply Chain
  • T1203 - Exploitation for Client Execution
  • T1012 - Query Registry
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1027.015 - Compression
MITREへのリンク →

APT28

Score: 61.18
Matched TTPs:
  • T1113 - Screen Capture
  • T1014 - Rootkit
  • T1542.003 - Bootkit
  • T1025 - Data from Removable Media
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1091 - Replication Through Removable Media
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1036 - Masquerading
  • T1583.006 - Web Services
  • T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
  • T1057 - Process Discovery
  • T1210 - Exploitation of Remote Services
  • T1588.002 - Tool
  • T1039 - Data from Network Shared Drive
  • T1546.015 - Component Object Model Hijacking
  • T1203 - Exploitation for Client Execution
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1001.001 - Junk Data
  • T1669 - Wi-Fi Networks
  • T1211 - Exploitation for Defense Evasion
MITREへのリンク →

GOLD SOUTHFIELD

Score: 9.28
Matched TTPs:
  • T1113 - Screen Capture
  • T1190 - Exploit Public-Facing Application
  • T1219 - Remote Access Tools
  • T1195.002 - Compromise Software Supply Chain
MITREへのリンク →

Group5

Score: 3.67
Matched TTPs:
  • T1113 - Screen Capture
  • T1070.004 - File Deletion
MITREへのリンク →

Dark Caracal

Score: 6.26
Matched TTPs:
  • T1113 - Screen Capture
  • T1005 - Data from Local System
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Scattered Spider

Score: 21.93
Matched TTPs:
  • T1006 - Direct Volume Access
  • T1082 - System Information Discovery
  • T1588.001 - Malware
  • T1657 - Financial Theft
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1219.002 - Remote Desktop Software
  • T1105 - Ingress Tool Transfer
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Winnti Group

Score: 5.58
Matched TTPs:
  • T1014 - Rootkit
  • T1057 - Process Discovery
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Rocke

Score: 23.79
Matched TTPs:
  • T1014 - Rootkit
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1082 - System Information Discovery
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1055.002 - Portable Executable Injection
  • T1057 - Process Discovery
  • T1562.001 - Disable or Modify Tools
  • T1027.004 - Compile After Delivery
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

TeamTNT

Score: 41.68
Matched TTPs:
  • T1014 - Rootkit
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1543.003 - Windows Service
  • T1007 - System Service Discovery
  • T1082 - System Information Discovery
  • T1140 - Deobfuscate/Decode Files or Information
  • T1608.001 - Upload Malware
  • T1219 - Remote Access Tools
  • T1036 - Masquerading
  • T1569.003 - Systemctl
  • T1610 - Deploy Container
  • T1057 - Process Discovery
  • T1562.001 - Disable or Modify Tools
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
  • T1680 - Local Storage Discovery
MITREへのリンク →

UNC3886

Score: 57.87
Matched TTPs:
  • T1014 - Rootkit
  • T1074.001 - Local Data Staging
  • T1587.001 - Malware
  • T1675 - ESXi Administration Command
  • T1190 - Exploit Public-Facing Application
  • T1681 - Search Threat Vendor Data
  • T1548 - Abuse Elevation Control Mechanism
  • T1673 - Virtual Machine Discovery
  • T1588.001 - Malware
  • T1057 - Process Discovery
  • T1554 - Compromise Host Software Binary
  • T1562.001 - Disable or Modify Tools
  • T1203 - Exploitation for Client Execution
  • T1570 - Lateral Tool Transfer
  • T1059.012 - Hypervisor CLI
  • T1070.004 - File Deletion
  • T1037.004 - RC Scripts
  • T1008 - Fallback Channels
  • T1505.006 - vSphere Installation Bundles
MITREへのリンク →

Turla

Score: 47.26
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1025 - Data from Removable Media
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1007 - System Service Discovery
  • T1082 - System Information Discovery
  • T1106 - Native API
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1055 - Process Injection
  • T1112 - Modify Registry
  • T1547.004 - Winlogon Helper DLL
  • T1588.001 - Malware
  • T1583.006 - Web Services
  • T1057 - Process Discovery
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1570 - Lateral Tool Transfer
  • T1012 - Query Registry
  • T1518.001 - Security Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1055.001 - Dynamic-link Library Injection
MITREへのリンク →

Storm-1811

Score: 23.79
Matched TTPs:
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1140 - Deobfuscate/Decode Files or Information
  • T1036 - Masquerading
  • T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
  • T1588.002 - Tool
  • T1056 - Input Capture
  • T1570 - Lateral Tool Transfer
  • T1219.002 - Remote Desktop Software
  • T1105 - Ingress Tool Transfer
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Sidewinder

Score: 12.67
Matched TTPs:
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1082 - System Information Discovery
  • T1057 - Process Discovery
  • T1203 - Exploitation for Client Execution
  • T1518.001 - Security Software Discovery
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

FIN5

Score: 4.13
Matched TTPs:
  • T1074.001 - Local Data Staging
  • T1588.002 - Tool
  • T1070.004 - File Deletion
MITREへのリンク →

APT5

Score: 17.43
Matched TTPs:
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1190 - Exploit Public-Facing Application
  • T1055 - Process Injection
  • T1654 - Log Enumeration
  • T1057 - Process Discovery
  • T1554 - Compromise Host Software Binary
  • T1070.004 - File Deletion
MITREへのリンク →

Agrius

Score: 16.51
Matched TTPs:
  • T1074.001 - Local Data Staging
  • T1543.003 - Windows Service
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1036 - Masquerading
  • T1041 - Exfiltration Over C2 Channel
  • T1562.001 - Disable or Modify Tools
  • T1570 - Lateral Tool Transfer
MITREへのリンク →

BackdoorDiplomacy

Score: 11.52
Matched TTPs:
  • T1074.001 - Local Data Staging
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1190 - Exploit Public-Facing Application
  • T1588.001 - Malware
  • T1588.002 - Tool
  • T1105 - Ingress Tool Transfer
  • T1055.001 - Dynamic-link Library Injection
MITREへのリンク →

Mustard Tempest

Score: 5.09
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1082 - System Information Discovery
  • T1608.001 - Upload Malware
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

WIRTE

Score: 7.08
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1140 - Deobfuscate/Decode Files or Information
  • T1588.002 - Tool
  • T1218.010 - Regsvr32
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Transparent Tribe

Score: 5.92
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1568 - Dynamic Resolution
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

admin@338

Score: 6.36
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1007 - System Service Discovery
  • T1082 - System Information Discovery
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Akira

Score: 15.22
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1219 - Remote Access Tools
  • T1027.001 - Binary Padding
  • T1657 - Financial Theft
  • T1562.001 - Disable or Modify Tools
  • T1531 - Account Access Removal
MITREへのリンク →

Ke3chang

Score: 24.52
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1587.001 - Malware
  • T1543.003 - Windows Service
  • T1007 - System Service Discovery
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1190 - Exploit Public-Facing Application
  • T1057 - Process Discovery
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1614.001 - System Language Discovery
  • T1105 - Ingress Tool Transfer
  • T1569.002 - Service Execution
MITREへのリンク →

Tropic Trooper

Score: 37.24
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1543.003 - Windows Service
  • T1082 - System Information Discovery
  • T1106 - Native API
  • T1091 - Replication Through Removable Media
  • T1140 - Deobfuscate/Decode Files or Information
  • T1547.004 - Winlogon Helper DLL
  • T1057 - Process Discovery
  • T1573 - Encrypted Channel
  • T1203 - Exploitation for Client Execution
  • T1027.003 - Steganography
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1680 - Local Storage Discovery
  • T1055.001 - Dynamic-link Library Injection
MITREへのリンク →

PROMETHIUM

Score: 3.07
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1543.003 - Windows Service
MITREへのリンク →

Carbanak

Score: 6.51
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1543.003 - Windows Service
  • T1219 - Remote Access Tools
  • T1588.002 - Tool
MITREへのリンク →

Darkhotel

Score: 24.05
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1497.001 - System Checks
  • T1082 - System Information Discovery
  • T1091 - Replication Through Removable Media
  • T1140 - Deobfuscate/Decode Files or Information
  • T1497 - Virtualization/Sandbox Evasion
  • T1057 - Process Discovery
  • T1497.002 - User Activity Based Checks
  • T1203 - Exploitation for Client Execution
  • T1518.001 - Security Software Discovery
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

APT1

Score: 9.93
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1007 - System Service Discovery
  • T1005 - Data from Local System
  • T1588.001 - Malware
  • T1057 - Process Discovery
  • T1588.002 - Tool
MITREへのリンク →

Sowbug

Score: 5.38
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1082 - System Information Discovery
  • T1039 - Data from Network Shared Drive
MITREへのリンク →

Poseidon Group

Score: 5.18
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1007 - System Service Discovery
  • T1057 - Process Discovery
MITREへのリンク →

SideCopy

Score: 12.02
Matched TTPs:
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1082 - System Information Discovery
  • T1106 - Native API
  • T1608.001 - Upload Malware
  • T1518.001 - Security Software Discovery
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Contagious Interview

Score: 47.09
Matched TTPs:
  • T1587.001 - Malware
  • T1082 - System Information Discovery
  • T1608.001 - Upload Malware
  • T1036 - Masquerading
  • T1681 - Search Threat Vendor Data
  • T1497 - Virtualization/Sandbox Evasion
  • T1657 - Financial Theft
  • T1583.006 - Web Services
  • T1041 - Exfiltration Over C2 Channel
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1543.001 - Launch Agent
  • T1219.002 - Remote Desktop Software
  • T1070.004 - File Deletion
  • T1204.004 - Malicious Copy and Paste
  • T1587 - Develop Capabilities
  • T1566.003 - Spearphishing via Service
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

Salt Typhoon

Score: 11.70
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1602.002 - Network Device Configuration Dump
  • T1588.002 - Tool
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

Play

Score: 15.51
Matched TTPs:
  • T1587.001 - Malware
  • T1082 - System Information Discovery
  • T1190 - Exploit Public-Facing Application
  • T1657 - Financial Theft
  • T1057 - Process Discovery
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Aoqin Dragon

Score: 11.89
Matched TTPs:
  • T1587.001 - Malware
  • T1091 - Replication Through Removable Media
  • T1036 - Masquerading
  • T1588.002 - Tool
  • T1203 - Exploitation for Client Execution
  • T1570 - Lateral Tool Transfer
MITREへのリンク →

Moses Staff

Score: 6.40
Matched TTPs:
  • T1587.001 - Malware
  • T1082 - System Information Discovery
  • T1190 - Exploit Public-Facing Application
  • T1588.002 - Tool
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

DarkVishnya

Score: 9.91
Matched TTPs:
  • T1543.003 - Windows Service
  • T1219 - Remote Access Tools
  • T1588.002 - Tool
  • T1200 - Hardware Additions
MITREへのリンク →

APT19

Score: 10.13
Matched TTPs:
  • T1543.003 - Windows Service
  • T1082 - System Information Discovery
  • T1140 - Deobfuscate/Decode Files or Information
  • T1112 - Modify Registry
  • T1588.002 - Tool
  • T1218.010 - Regsvr32
MITREへのリンク →

Evilnum

Score: 8.53
Matched TTPs:
  • T1497.001 - System Checks
  • T1219.002 - Remote Desktop Software
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Windigo

Score: 5.40
Matched TTPs:
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1518 - Software Discovery
MITREへのリンク →

ZIRCONIUM

Score: 15.24
Matched TTPs:
  • T1082 - System Information Discovery
  • T1218.007 - Msiexec
  • T1140 - Deobfuscate/Decode Files or Information
  • T1036 - Masquerading
  • T1583.006 - Web Services
  • T1041 - Exfiltration Over C2 Channel
  • T1012 - Query Registry
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Inception

Score: 12.01
Matched TTPs:
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1057 - Process Discovery
  • T1588.002 - Tool
  • T1218.010 - Regsvr32
  • T1203 - Exploitation for Client Execution
  • T1518 - Software Discovery
MITREへのリンク →

CURIUM

Score: 10.99
Matched TTPs:
  • T1082 - System Information Discovery
  • T1005 - Data from Local System
  • T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
  • T1041 - Exfiltration Over C2 Channel
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Malteiro

Score: 13.75
Matched TTPs:
  • T1082 - System Information Discovery
  • T1140 - Deobfuscate/Decode Files or Information
  • T1657 - Financial Theft
  • T1614.001 - System Language Discovery
  • T1518.001 - Security Software Discovery
  • T1055.001 - Dynamic-link Library Injection
MITREへのリンク →

APT18

Score: 3.36
Matched TTPs:
  • T1082 - System Information Discovery
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

TA505

Score: 19.75
Matched TTPs:
  • T1218.007 - Msiexec
  • T1106 - Native API
  • T1140 - Deobfuscate/Decode Files or Information
  • T1608.001 - Upload Malware
  • T1112 - Modify Registry
  • T1588.001 - Malware
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1105 - Ingress Tool Transfer
  • T1055.001 - Dynamic-link Library Injection
MITREへのリンク →

Gorgon Group

Score: 16.86
Matched TTPs:
  • T1106 - Native API
  • T1140 - Deobfuscate/Decode Files or Information
  • T1547.009 - Shortcut Modification
  • T1112 - Modify Registry
  • T1055.002 - Portable Executable Injection
  • T1588.002 - Tool
  • T1562.001 - Disable or Modify Tools
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

BlackTech

Score: 6.10
Matched TTPs:
  • T1106 - Native API
  • T1190 - Exploit Public-Facing Application
  • T1588.002 - Tool
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

LAPSUS$

Score: 8.89
Matched TTPs:
  • T1005 - Data from Local System
  • T1588.001 - Malware
  • T1588.002 - Tool
  • T1531 - Account Access Removal
MITREへのリンク →

HAFNIUM

Score: 10.85
Matched TTPs:
  • T1005 - Data from Local System
  • T1190 - Exploit Public-Facing Application
  • T1584.005 - Botnet
  • T1583.006 - Web Services
  • T1057 - Process Discovery
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Axiom

Score: 15.86
Matched TTPs:
  • T1005 - Data from Local System
  • T1190 - Exploit Public-Facing Application
  • T1546.008 - Accessibility Features
  • T1584.005 - Botnet
  • T1203 - Exploitation for Client Execution
  • T1001.002 - Steganography
MITREへのリンク →

Andariel

Score: 10.73
Matched TTPs:
  • T1005 - Data from Local System
  • T1588.001 - Malware
  • T1057 - Process Discovery
  • T1203 - Exploitation for Client Execution
  • T1027.003 - Steganography
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

LazyScripter

Score: 9.41
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1036 - Masquerading
  • T1588.001 - Malware
  • T1583.006 - Web Services
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Saint Bear

Score: 12.95
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1112 - Modify Registry
  • T1497 - Virtualization/Sandbox Evasion
  • T1583.006 - Web Services
  • T1562.001 - Disable or Modify Tools
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

EXOTIC LILY

Score: 5.99
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Sea Turtle

Score: 7.43
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1588.002 - Tool
  • T1203 - Exploitation for Client Execution
  • T1027.004 - Compile After Delivery
MITREへのリンク →

TA551

Score: 8.74
Matched TTPs:
  • T1036 - Masquerading
  • T1218.010 - Regsvr32
  • T1027.003 - Steganography
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

PLATINUM

Score: 9.96
Matched TTPs:
  • T1036 - Masquerading
  • T1055 - Process Injection
  • T1105 - Ingress Tool Transfer
  • T1056.004 - Credential API Hooking
MITREへのリンク →

Moafee

Score: 3.03
Matched TTPs:
  • T1027.001 - Binary Padding
MITREへのリンク →

Leafminer

Score: 5.39
Matched TTPs:
  • T1055.013 - Process Doppelgänging
  • T1588.002 - Tool
MITREへのリンク →

Metador

Score: 5.47
Matched TTPs:
  • T1588.001 - Malware
  • T1588.002 - Tool
  • T1070.004 - File Deletion
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Equation

Score: 8.67
Matched TTPs:
  • T1542.002 - Component Firmware
  • T1564.005 - Hidden File System
MITREへのリンク →

RedEcho

Score: 3.29
Matched TTPs:
  • T1568 - Dynamic Resolution
MITREへのリンク →

IndigoZebra

Score: 3.64
Matched TTPs:
  • T1583.006 - Web Services
  • T1588.002 - Tool
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Tonto Team

Score: 5.02
Matched TTPs:
  • T1210 - Exploitation of Remote Services
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

FIN4

Score: 4.13
Matched TTPs:
  • T1056.002 - GUI Input Capture
MITREへのリンク →

Thrip

Score: 6.52
Matched TTPs:
  • T1588.002 - Tool
  • T1219.002 - Remote Desktop Software
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

Putter Panda

Score: 4.73
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1055.001 - Dynamic-link Library Injection
MITREへのリンク →

The White Company

Score: 4.77
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
MITREへのリンク →

Strider

Score: 4.13
Matched TTPs:
  • T1564.005 - Hidden File System
MITREへのリンク →

Ajax Security Team

Score: 3.30
Matched TTPs:
  • T1105 - Ingress Tool Transfer
  • T1566.003 - Spearphishing via Service
MITREへのリンク →

Mofang

Score: 3.15
Matched TTPs:
  • T1027.015 - Compression
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Lazarus Group

Score: 0.81
Matched TTPs:
  • T1547.009 - Shortcut Modification
  • T1070.004 - File Deletion
  • T1680 - Local Storage Discovery
  • T1041 - Exfiltration Over C2 Channel
  • T1561.002 - Disk Structure Wipe
  • T1047 - Windows Management Instrumentation
  • T1057 - Process Discovery
  • T1529 - System Shutdown/Reboot
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1012 - Query Registry
  • T1583.006 - Web Services
  • T1587.001 - Malware
  • T1620 - Reflective Code Loading
  • T1562.001 - Disable or Modify Tools
  • T1543.003 - Windows Service
  • T1566.003 - Spearphishing via Service
  • T1561.001 - Disk Content Wipe
  • T1574.013 - KernelCallbackTable
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
  • T1010 - Application Window Discovery
  • T1542.003 - Bootkit
  • T1202 - Indirect Command Execution
  • T1053.005 - Scheduled Task
  • T1588.002 - Tool
  • T1218 - System Binary Proxy Execution
  • T1055.001 - Dynamic-link Library Injection
  • T1008 - Fallback Channels
  • T1082 - System Information Discovery
  • T1001.003 - Protocol or Service Impersonation
  • T1036.003 - Rename Legitimate Utilities
  • T1027.007 - Dynamic API Resolution
  • T1074.001 - Local Data Staging
  • T1203 - Exploitation for Client Execution
  • T1106 - Native API
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

FIN7

Score: 0.59
Matched TTPs:
  • T1047 - Windows Management Instrumentation
  • T1057 - Process Discovery
  • T1005 - Data from Local System
  • T1569.002 - Service Execution
  • T1140 - Deobfuscate/Decode Files or Information
  • T1583.006 - Web Services
  • T1587.001 - Malware
  • T1620 - Reflective Code Loading
  • T1091 - Replication Through Removable Media
  • T1543.003 - Windows Service
  • T1195.002 - Compromise Software Supply Chain
  • T1674 - Input Injection
  • T1546.011 - Application Shimming
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1113 - Screen Capture
  • T1053.005 - Scheduled Task
  • T1588.002 - Tool
  • T1210 - Exploitation of Remote Services
  • T1008 - Fallback Channels
  • T1082 - System Information Discovery
  • T1497.002 - User Activity Based Checks
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1219 - Remote Access Tools
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Gamaredon Group

Score: 0.58
Matched TTPs:
  • T1112 - Modify Registry
  • T1518.001 - Security Software Discovery
  • T1070.004 - File Deletion
  • T1041 - Exfiltration Over C2 Channel
  • T1025 - Data from Removable Media
  • T1047 - Windows Management Instrumentation
  • T1057 - Process Discovery
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1012 - Query Registry
  • T1583.006 - Web Services
  • T1620 - Reflective Code Loading
  • T1562.001 - Disable or Modify Tools
  • T1091 - Replication Through Removable Media
  • T1027.015 - Compression
  • T1055 - Process Injection
  • T1561.001 - Disk Content Wipe
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1113 - Screen Capture
  • T1027.004 - Compile After Delivery
  • T1039 - Data from Network Shared Drive
  • T1497.001 - System Checks
  • T1053.005 - Scheduled Task
  • T1588.002 - Tool
  • T1082 - System Information Discovery
  • T1568 - Dynamic Resolution
  • T1608.001 - Upload Malware
  • T1106 - Native API
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

APT28

Score: 0.57
Matched TTPs:
  • T1070.004 - File Deletion
  • T1001.001 - Junk Data
  • T1025 - Data from Removable Media
  • T1057 - Process Discovery
  • T1005 - Data from Local System
  • T1140 - Deobfuscate/Decode Files or Information
  • T1583.006 - Web Services
  • T1091 - Replication Through Removable Media
  • T1669 - Wi-Fi Networks
  • T1036.005 - Match Legitimate Resource Name or Location
  • T1048.002 - Exfiltration Over Asymmetric Encrypted Non-C2 Protocol
  • T1113 - Screen Capture
  • T1542.003 - Bootkit
  • T1039 - Data from Network Shared Drive
  • T1546.015 - Component Object Model Hijacking
  • T1588.002 - Tool
  • T1210 - Exploitation of Remote Services
  • T1036 - Masquerading
  • T1074.001 - Local Data Staging
  • T1211 - Exploitation for Defense Evasion
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1014 - Rootkit
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

UNC3886

Score: 0.56
Matched TTPs:
  • T1070.004 - File Deletion
  • T1059.012 - Hypervisor CLI
  • T1675 - ESXi Administration Command
  • T1057 - Process Discovery
  • T1588.001 - Malware
  • T1587.001 - Malware
  • T1570 - Lateral Tool Transfer
  • T1562.001 - Disable or Modify Tools
  • T1037.004 - RC Scripts
  • T1548 - Abuse Elevation Control Mechanism
  • T1554 - Compromise Host Software Binary
  • T1681 - Search Threat Vendor Data
  • T1008 - Fallback Channels
  • T1673 - Virtual Machine Discovery
  • T1505.006 - vSphere Installation Bundles
  • T1074.001 - Local Data Staging
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1014 - Rootkit
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る