Trusted Design

NetTraveler Spear-Phishing Email Targets Diplomat of Uzbekistan

概要

Unit 42 recently identified a targeted attack against an individual working for the Foreign Ministry of Afghanistan in China. A spear-phishing email was sent to a diplomat of the Embassy of Uzbekistan who is likely based in Beijing, China. In this report, we’ll review how the actors attempted to exploit CVE-2012-0158 to install the NetTraveler Trojan.

Created: 2026-02-23

Indicators

類似Pulses

NetTraveler APT Targets Russian, European Interests (score: 0.78)
Attacks Against the Mongolian Government (score: 0.70)
MALWARE POSING AS HUMAN RIGHTS ORGANIZATIONS AND COMMERCIAL SOFTWARE TARGETING IRANIANS AND FOREIGN POLICY INSTITUTIONS (score: 0.69)
Chinese Actors attacks on US Government and EU Media (score: 0.67)
New Sofacy Attacks Against US Government Agency (score: 0.65)

このPulseに関連する脅威アクター (事実ベース)

LAPSUS$

Score: 15.55

Matched TTPs:

T1216.001 - PubPrn
T1019 - System Firmware
T1193 - Spearphishing Attachment
T1030 - Data Transfer Size Limits

MITREへのリンク →

Ember Bear

Score: 8.26

Matched TTPs:

T1564.008 - Email Hiding Rules
T1003.003 - NTDS

MITREへのリンク →

Sandworm Team

Score: 19.33

Matched TTPs:

T1564.008 - Email Hiding Rules
T1114 - Email Collection
T1543.003 - Windows Service
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1193 - Spearphishing Attachment
T1102.003 - One-Way Communication

MITREへのリンク →

Volt Typhoon

Score: 17.61

Matched TTPs:

T1685.001 - Disable or Modify Windows Event Log
T1114 - Email Collection
T1057 - Process Discovery
T1102.003 - One-Way Communication
T1584.002 - DNS Server

MITREへのリンク →

APT28

Score: 18.22

Matched TTPs:

T1685.001 - Disable or Modify Windows Event Log
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1139 - Bash History
T1057 - Process Discovery
T1197 - BITS Jobs

MITREへのリンク →

ZIRCONIUM

Score: 10.97

Matched TTPs:

T1685.001 - Disable or Modify Windows Event Log
T1543.003 - Windows Service
T1566.002 - Spearphishing Link
T1197 - BITS Jobs

MITREへのリンク →

Leviathan

Score: 9.56

Matched TTPs:

T1685.001 - Disable or Modify Windows Event Log
T1543.003 - Windows Service
T1598.003 - Spearphishing Link
T1055.014 - VDSO Hijacking

MITREへのリンク →

Silent Librarian

Score: 5.74

Matched TTPs:

T1114 - Email Collection
T1566.002 - Spearphishing Link

MITREへのリンク →

Kimsuky

Score: 38.52

Matched TTPs:

T1114 - Email Collection
T1543.003 - Windows Service
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1552.003 - Shell History
T1057 - Process Discovery
T1055.014 - VDSO Hijacking
T1102.003 - One-Way Communication
T1562.013 - Disable or Modify Network Device Firewall
T1690 - Prevent Command History Logging
T1030 - Data Transfer Size Limits
T1197 - BITS Jobs
T1003.003 - NTDS

MITREへのリンク →

EXOTIC LILY

Score: 11.97

Matched TTPs:

T1114 - Email Collection
T1543.003 - Windows Service
T1598.003 - Spearphishing Link
T1690 - Prevent Command History Logging
T1547.008 - LSASS Driver

MITREへのリンク →

TA578

Score: 3.29

Matched TTPs:

T1114 - Email Collection

MITREへのリンク →

Sidewinder

Score: 8.40

Matched TTPs:

T1543.003 - Windows Service
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1657 - Financial Theft

MITREへのリンク →

FIN7

Score: 5.61

Matched TTPs:

T1543.003 - Windows Service
T1598.003 - Spearphishing Link
T1057 - Process Discovery

MITREへのリンク →

Mustang Panda

Score: 8.07

Matched TTPs:

T1543.003 - Windows Service
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1102.003 - One-Way Communication

MITREへのリンク →

APT32

Score: 4.78

Matched TTPs:

T1543.003 - Windows Service
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link

MITREへのリンク →

Lazarus Group

Score: 8.13

Matched TTPs:

T1543.003 - Windows Service
T1598.003 - Spearphishing Link
T1057 - Process Discovery
T1547.008 - LSASS Driver

MITREへのリンク →

Magic Hound

Score: 10.97

Matched TTPs:

T1543.003 - Windows Service
T1566.002 - Spearphishing Link
T1098.002 - Additional Email Delegate Permissions
T1547.008 - LSASS Driver

MITREへのリンク →

OilRig

Score: 4.84

Matched TTPs:

T1543.003 - Windows Service
T1598.003 - Spearphishing Link
T1547.008 - LSASS Driver

MITREへのリンク →

Windshift

Score: 4.84

Matched TTPs:

T1543.003 - Windows Service
T1598.003 - Spearphishing Link
T1547.008 - LSASS Driver

MITREへのリンク →

APT29

Score: 4.84

Matched TTPs:

T1543.003 - Windows Service
T1598.003 - Spearphishing Link
T1547.008 - LSASS Driver

MITREへのリンク →

Storm-1811

Score: 16.08

Matched TTPs:

T1543.003 - Windows Service
T1486 - Data Encrypted for Impact
T1567.003 - Exfiltration to Text Storage Sites
T1030 - Data Transfer Size Limits
T1547.008 - LSASS Driver

MITREへのリンク →

Patchwork

Score: 4.78

Matched TTPs:

T1543.003 - Windows Service
T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link

MITREへのリンク →

APT42

Score: 4.48

Matched TTPs:

T1543.003 - Windows Service
T1030 - Data Transfer Size Limits

MITREへのリンク →

Scattered Spider

Score: 20.13

Matched TTPs:

T1566.002 - Spearphishing Link
T1019 - System Firmware
T1552.003 - Shell History
T1030 - Data Transfer Size Limits
T1197 - BITS Jobs
T1027.002 - Software Packing

MITREへのリンク →

Star Blizzard

Score: 10.24

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1657 - Financial Theft
T1102.003 - One-Way Communication

MITREへのリンク →

Moonstone Sleet

Score: 12.58

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1057 - Process Discovery
T1197 - BITS Jobs
T1547.008 - LSASS Driver

MITREへのリンク →

CURIUM

Score: 5.86

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1547.008 - LSASS Driver

MITREへのリンク →

Dragonfly

Score: 10.80

Matched TTPs:

T1566.002 - Spearphishing Link
T1598.003 - Spearphishing Link
T1193 - Spearphishing Attachment
T1657 - Financial Theft

MITREへのリンク →

Saint Bear

Score: 3.91

Matched TTPs:

T1598.003 - Spearphishing Link
T1030 - Data Transfer Size Limits

MITREへのリンク →

FIN6

Score: 3.40

Matched TTPs:

T1598.003 - Spearphishing Link
T1547.008 - LSASS Driver

MITREへのリンク →

Gamaredon Group

Score: 4.50

Matched TTPs:

T1598.003 - Spearphishing Link
T1055.014 - VDSO Hijacking

MITREへのリンク →

Ajax Security Team

Score: 3.40

Matched TTPs:

T1598.003 - Spearphishing Link
T1547.008 - LSASS Driver

MITREへのリンク →

APT41

Score: 3.91

Matched TTPs:

T1598.003 - Spearphishing Link
T1030 - Data Transfer Size Limits

MITREへのリンク →

Malteiro

Score: 3.40

Matched TTPs:

T1598.003 - Spearphishing Link
T1552.003 - Shell History

MITREへのリンク →

SideCopy

Score: 8.63

Matched TTPs:

T1598.003 - Spearphishing Link
T1657 - Financial Theft
T1584.002 - DNS Server

MITREへのリンク →

INC Ransom

Score: 5.81

Matched TTPs:

T1552.003 - Shell History
T1562.013 - Disable or Modify Network Device Firewall

MITREへのリンク →

Contagious Interview

Score: 15.21

Matched TTPs:

T1552.003 - Shell History
T1102.003 - One-Way Communication
T1690 - Prevent Command History Logging
T1030 - Data Transfer Size Limits
T1547.008 - LSASS Driver

MITREへのリンク →

AppleJeus

Score: 5.81

Matched TTPs:

T1552.003 - Shell History
T1562.013 - Disable or Modify Network Device Firewall

MITREへのリンク →

HEXANE

Score: 3.62

Matched TTPs:

T1055.014 - VDSO Hijacking

MITREへのリンク →

Sea Turtle

Score: 3.29

Matched TTPs:

T1562.013 - Disable or Modify Network Device Firewall

MITREへのリンク →

Axiom

Score: 3.29

Matched TTPs:

T1562.013 - Disable or Modify Network Device Firewall

MITREへのリンク →

GOLD SOUTHFIELD

Score: 3.29

Matched TTPs:

T1562.013 - Disable or Modify Network Device Firewall

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.83

Matched TTPs:

T1566.002 - Spearphishing Link
T1102.003 - One-Way Communication
T1114 - Email Collection
T1055.014 - VDSO Hijacking
T1543.003 - Windows Service
T1057 - Process Discovery
T1562.013 - Disable or Modify Network Device Firewall
T1690 - Prevent Command History Logging
T1197 - BITS Jobs
T1598.003 - Spearphishing Link
T1030 - Data Transfer Size Limits
T1552.003 - Shell History
T1003.003 - NTDS

MITREへのリンク →

Related CVEs

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る