Trusted Design

Exploring Bergard: Old Malware with New Tricks

概要

The Bergard Trojan and the C0d0so group that made it famous with the November 2014 watering hole attack [1] via Forbes.com have received renewed attention recently, with other researchers [2] potentially linking emerging tools and recent attacks to the group. Proofpoint researchers conducted a historical analysis of samples related to this research and uncovered new malware variants and likely origins and methods of infection. Many of these samples have not been discussed publicly and several have very little or no anti-virus coverage. The analysis that follows is of completed, historical attacks as well as an extremely recent and ongoing attack, providing insight into the volume and timeline of infections, as well as a timeline for attacker-initiated actions using a novel malware family.

Created: 2026-02-23

Indicators

類似Pulses

このPulseに関連する脅威アクター (事実ベース)

Kimsuky

Score: 10.51
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
  • T1680 - Local Storage Discovery
MITREへのリンク →

FIN13

Score: 4.34
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Moonstone Sleet

Score: 4.85
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Lazarus Group

Score: 17.55
Matched TTPs:
  • T1587.001 - Malware
  • T1070 - Indicator Removal
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1027.007 - Dynamic API Resolution
  • T1680 - Local Storage Discovery
  • T1124 - System Time Discovery
MITREへのリンク →

Contagious Interview

Score: 5.43
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1204.001 - Malicious Link
MITREへのリンク →

OilRig

Score: 14.29
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1203 - Exploitation for Client Execution
  • T1573.002 - Asymmetric Cryptography
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

UNC3886

Score: 7.65
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1124 - System Time Discovery
MITREへのリンク →

LuminousMoth

Score: 6.21
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Sandworm Team

Score: 16.64
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1190 - Exploit Public-Facing Application
  • T1584.005 - Botnet
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Salt Typhoon

Score: 3.57
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

APT29

Score: 11.04
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1550.003 - Pass the Ticket
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Play

Score: 4.34
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Aoqin Dragon

Score: 3.59
Matched TTPs:
  • T1587.001 - Malware
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

RedCurl

Score: 6.20
Matched TTPs:
  • T1587.001 - Malware
  • T1573.002 - Asymmetric Cryptography
  • T1204.001 - Malicious Link
MITREへのリンク →

Moses Staff

Score: 4.34
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Turla

Score: 6.82
Matched TTPs:
  • T1587.001 - Malware
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
  • T1124 - System Time Discovery
MITREへのリンク →

Ke3chang

Score: 4.34
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Mustang Panda

Score: 22.74
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1070 - Indicator Removal
  • T1678 - Delay Execution
  • T1203 - Exploitation for Client Execution
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1027.007 - Dynamic API Resolution
  • T1204.001 - Malicious Link
MITREへのリンク →

TeamTNT

Score: 7.68
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1105 - Ingress Tool Transfer
  • T1680 - Local Storage Discovery
MITREへのリンク →

FIN7

Score: 10.27
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
  • T1124 - System Time Discovery
MITREへのリンク →

TA2541

Score: 6.86
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1573.002 - Asymmetric Cryptography
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Earth Lusca

Score: 4.80
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1204.001 - Malicious Link
MITREへのリンク →

Mustard Tempest

Score: 8.65
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1608.006 - SEO Poisoning
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

LazyScripter

Score: 4.11
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Gamaredon Group

Score: 4.11
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Threat Group-3390

Score: 9.85
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1608.002 - Upload Tool
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

SideCopy

Score: 5.50
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

TA505

Score: 4.11
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

BlackByte

Score: 4.22
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

BITTER

Score: 4.24
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

APT32

Score: 9.45
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1550.003 - Pass the Ticket
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

HEXANE

Score: 5.50
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Saint Bear

Score: 4.83
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
  • T1204.001 - Malicious Link
MITREへのリンク →

EXOTIC LILY

Score: 4.83
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
  • T1204.001 - Malicious Link
MITREへのリンク →

APT42

Score: 8.34
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1070 - Indicator Removal
  • T1573.002 - Asymmetric Cryptography
MITREへのリンク →

Ember Bear

Score: 6.81
Matched TTPs:
  • T1195 - Supply Chain Compromise
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Volt Typhoon

Score: 14.04
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1584.005 - Botnet
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1680 - Local Storage Discovery
  • T1124 - System Time Discovery
MITREへのリンク →

APT28

Score: 9.64
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1498 - Network Denial of Service
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

BlackTech

Score: 4.32
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1204.001 - Malicious Link
MITREへのリンク →

Magic Hound

Score: 3.61
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Medusa Group

Score: 9.13
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1608.002 - Upload Tool
  • T1573.002 - Asymmetric Cryptography
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

ToddyCat

Score: 4.30
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1680 - Local Storage Discovery
MITREへのリンク →

Winter Vivern

Score: 3.61
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Leviathan

Score: 5.10
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Dragonfly

Score: 3.74
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

Axiom

Score: 6.59
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1584.005 - Botnet
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

APT41

Score: 3.74
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

HAFNIUM

Score: 5.87
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1584.005 - Botnet
  • T1105 - Ingress Tool Transfer
MITREへのリンク →

APT5

Score: 5.09
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1070 - Indicator Removal
MITREへのリンク →

MuddyWater

Score: 7.85
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

APT39

Score: 3.61
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

BRONZE BUTLER

Score: 11.45
Matched TTPs:
  • T1550.003 - Pass the Ticket
  • T1203 - Exploitation for Client Execution
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1124 - System Time Discovery
MITREへのリンク →

APT33

Score: 7.76
Matched TTPs:
  • T1552.006 - Group Policy Preferences
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Wizard Spider

Score: 6.27
Matched TTPs:
  • T1552.006 - Group Policy Preferences
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Sidewinder

Score: 8.97
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
  • T1124 - System Time Discovery
MITREへのリンク →

The White Company

Score: 4.09
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1124 - System Time Discovery
MITREへのリンク →

Confucius

Score: 6.46
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
  • T1680 - Local Storage Discovery
MITREへのリンク →

Patchwork

Score: 6.46
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
  • T1680 - Local Storage Discovery
MITREへのリンク →

Higaisa

Score: 6.92
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1680 - Local Storage Discovery
  • T1124 - System Time Discovery
MITREへのリンク →

Cobalt Group

Score: 6.38
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1573.002 - Asymmetric Cryptography
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

APT3

Score: 3.63
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Tropic Trooper

Score: 10.60
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1573.002 - Asymmetric Cryptography
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1680 - Local Storage Discovery
MITREへのリンク →

Inception

Score: 4.24
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1518 - Software Discovery
MITREへのリンク →

Elderwood

Score: 3.63
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Darkhotel

Score: 4.86
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1124 - System Time Discovery
MITREへのリンク →

FIN8

Score: 4.88
Matched TTPs:
  • T1573.002 - Asymmetric Cryptography
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

Windshift

Score: 4.88
Matched TTPs:
  • T1518 - Software Discovery
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
MITREへのリンク →

PLATINUM

Score: 5.31
Matched TTPs:
  • T1105 - Ingress Tool Transfer
  • T1056.004 - Credential API Hooking
MITREへのリンク →

ZIRCONIUM

Score: 4.73
Matched TTPs:
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
  • T1124 - System Time Discovery
MITREへのリンク →

Chimera

Score: 6.20
Matched TTPs:
  • T1105 - Ingress Tool Transfer
  • T1680 - Local Storage Discovery
  • T1124 - System Time Discovery
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Mustang Panda

Score: 0.79
Matched TTPs:
  • T1027.007 - Dynamic API Resolution
  • T1070 - Indicator Removal
  • T1678 - Delay Execution
  • T1608.001 - Upload Malware
  • T1518 - Software Discovery
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
  • T1587.001 - Malware
MITREへのリンク →

Lazarus Group

Score: 0.65
Matched TTPs:
  • T1680 - Local Storage Discovery
  • T1027.007 - Dynamic API Resolution
  • T1070 - Indicator Removal
  • T1203 - Exploitation for Client Execution
  • T1105 - Ingress Tool Transfer
  • T1124 - System Time Discovery
  • T1587.001 - Malware
MITREへのリンク →

Sandworm Team

Score: 0.64
Matched TTPs:
  • T1584.005 - Botnet
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
  • T1190 - Exploit Public-Facing Application
  • T1195 - Supply Chain Compromise
  • T1105 - Ingress Tool Transfer
  • T1204.001 - Malicious Link
  • T1587.001 - Malware
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る