Trusted Design

PROOFPOINT 2016-03-01: Operation Transparent Tribe

概要

Proofpoint researchers recently uncovered evidence of an advanced persistent threat (APT) against Indian diplomatic and military resources. Our investigation began with malicious emails sent to Indian embassies in Saudi Arabia and Kazakstan but turned up connections to watering hole sites focused on Indian military personnel and designed to drop a remote access Trojan (RAT) with a variety of data extration functions. Our analysis shows that many of the campaigns and attacks appear related by common IOCs, vectors, payloads, and language, but the exact nature and attribution associated with this APT remain under investigation.

Created: 2026-02-23

Indicators

Indicatorsは見つかっていない。

類似Pulses

このPulseに関連する脅威アクター (事実ベース)

Volt Typhoon

Score: 45.25
Matched TTPs:
  • T1592 - Gather Victim Host Information
  • T1594 - Search Victim-Owned Websites
  • T1590.004 - Network Topology
  • T1190 - Exploit Public-Facing Application
  • T1590.006 - Network Security Appliances
  • T1584.005 - Botnet
  • T1591 - Gather Victim Org Information
  • T1590 - Gather Victim Network Information
  • T1593 - Search Open Websites/Domains
  • T1614 - System Location Discovery
  • T1591.004 - Identify Roles
  • T1021.001 - Remote Desktop Protocol
  • T1596.005 - Scan Databases
MITREへのリンク →

LAPSUS$

Score: 19.69
Matched TTPs:
  • T1597.002 - Purchase Technical Data
  • T1591.002 - Business Relationships
  • T1593.003 - Code Repositories
  • T1591.004 - Identify Roles
  • T1213.005 - Messaging Applications
MITREへのリンク →

Contagious Interview

Score: 31.00
Matched TTPs:
  • T1588.007 - Artificial Intelligence
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1681 - Search Threat Vendor Data
  • T1593.003 - Code Repositories
  • T1657 - Financial Theft
  • T1583.006 - Web Services
  • T1593 - Search Open Websites/Domains
  • T1593.001 - Social Media
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

Scattered Spider

Score: 22.77
Matched TTPs:
  • T1564.008 - Email Hiding Rules
  • T1114 - Email Collection
  • T1598.003 - Spearphishing Link
  • T1657 - Financial Theft
  • T1538 - Cloud Service Dashboard
  • T1021.001 - Remote Desktop Protocol
  • T1213.005 - Messaging Applications
MITREへのリンク →

FIN4

Score: 4.13
Matched TTPs:
  • T1564.008 - Email Hiding Rules
MITREへのリンク →

Ember Bear

Score: 18.69
Matched TTPs:
  • T1491.002 - External Defacement
  • T1114 - Email Collection
  • T1195 - Supply Chain Compromise
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1595.001 - Scanning IP Blocks
MITREへのリンク →

Sandworm Team

Score: 42.92
Matched TTPs:
  • T1491.002 - External Defacement
  • T1594 - Search Victim-Owned Websites
  • T1587.001 - Malware
  • T1598.003 - Spearphishing Link
  • T1040 - Network Sniffing
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1190 - Exploit Public-Facing Application
  • T1591.002 - Business Relationships
  • T1584.005 - Botnet
  • T1593 - Search Open Websites/Domains
  • T1592.002 - Software
  • T1203 - Exploitation for Client Execution
  • T1499 - Endpoint Denial of Service
MITREへのリンク →

Andariel

Score: 9.18
Matched TTPs:
  • T1590.005 - IP Addresses
  • T1592.002 - Software
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Magic Hound

Score: 23.44
Matched TTPs:
  • T1590.005 - IP Addresses
  • T1114 - Email Collection
  • T1598.003 - Spearphishing Link
  • T1190 - Exploit Public-Facing Application
  • T1583.006 - Web Services
  • T1592.002 - Software
  • T1021.001 - Remote Desktop Protocol
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

HAFNIUM

Score: 23.18
Matched TTPs:
  • T1590.005 - IP Addresses
  • T1190 - Exploit Public-Facing Application
  • T1593.003 - Code Repositories
  • T1592.004 - Client Configurations
  • T1584.005 - Botnet
  • T1583.006 - Web Services
  • T1590 - Gather Victim Network Information
MITREへのリンク →

Silent Librarian

Score: 9.37
Matched TTPs:
  • T1114 - Email Collection
  • T1594 - Search Victim-Owned Websites
  • T1598.003 - Spearphishing Link
MITREへのリンク →

Kimsuky

Score: 39.58
Matched TTPs:
  • T1594 - Search Victim-Owned Websites
  • T1587.001 - Malware
  • T1598.003 - Spearphishing Link
  • T1040 - Network Sniffing
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1596 - Search Open Technical Databases
  • T1593.002 - Search Engines
  • T1657 - Financial Theft
  • T1583.006 - Web Services
  • T1591 - Gather Victim Org Information
  • T1593 - Search Open Websites/Domains
  • T1593.001 - Social Media
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

EXOTIC LILY

Score: 15.13
Matched TTPs:
  • T1594 - Search Victim-Owned Websites
  • T1608.001 - Upload Malware
  • T1597 - Search Closed Sources
  • T1593.001 - Social Media
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

TA578

Score: 5.30
Matched TTPs:
  • T1594 - Search Victim-Owned Websites
  • T1583.006 - Web Services
MITREへのリンク →

FIN13

Score: 11.58
Matched TTPs:
  • T1587.001 - Malware
  • T1590.004 - Network Topology
  • T1190 - Exploit Public-Facing Application
  • T1657 - Financial Theft
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Moonstone Sleet

Score: 9.81
Matched TTPs:
  • T1587.001 - Malware
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1591 - Gather Victim Org Information
MITREへのリンク →

Indrik Spider

Score: 7.59
Matched TTPs:
  • T1587.001 - Malware
  • T1590 - Gather Victim Network Information
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Lazarus Group

Score: 21.44
Matched TTPs:
  • T1587.001 - Malware
  • T1070 - Indicator Removal
  • T1583.006 - Web Services
  • T1591 - Gather Victim Org Information
  • T1574.013 - KernelCallbackTable
  • T1203 - Exploitation for Client Execution
  • T1021.001 - Remote Desktop Protocol
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

OilRig

Score: 13.80
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1203 - Exploitation for Client Execution
  • T1021.001 - Remote Desktop Protocol
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

UNC3886

Score: 12.23
Matched TTPs:
  • T1587.001 - Malware
  • T1040 - Network Sniffing
  • T1190 - Exploit Public-Facing Application
  • T1681 - Search Threat Vendor Data
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

LuminousMoth

Score: 4.07
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
MITREへのリンク →

Salt Typhoon

Score: 13.19
Matched TTPs:
  • T1587.001 - Malware
  • T1040 - Network Sniffing
  • T1590.004 - Network Topology
  • T1190 - Exploit Public-Facing Application
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

APT29

Score: 7.07
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Play

Score: 6.09
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1657 - Financial Theft
MITREへのリンク →

Aoqin Dragon

Score: 3.59
Matched TTPs:
  • T1587.001 - Malware
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

RedCurl

Score: 5.13
Matched TTPs:
  • T1587.001 - Malware
  • T1039 - Data from Network Shared Drive
MITREへのリンク →

Moses Staff

Score: 3.57
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

Turla

Score: 7.73
Matched TTPs:
  • T1587.001 - Malware
  • T1583.006 - Web Services
  • T1584.006 - Web Services
MITREへのリンク →

Ke3chang

Score: 7.19
Matched TTPs:
  • T1587.001 - Malware
  • T1190 - Exploit Public-Facing Application
  • T1614.001 - System Language Discovery
MITREへのリンク →

Mustang Panda

Score: 24.22
Matched TTPs:
  • T1587.001 - Malware
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1070 - Indicator Removal
  • T1583.006 - Web Services
  • T1593 - Search Open Websites/Domains
  • T1678 - Delay Execution
  • T1203 - Exploitation for Client Execution
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

TeamTNT

Score: 8.20
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1595.001 - Scanning IP Blocks
MITREへのリンク →

FIN7

Score: 16.11
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1583.006 - Web Services
  • T1591 - Gather Victim Org Information
  • T1591.004 - Identify Roles
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Sidewinder

Score: 7.57
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1598.002 - Spearphishing Attachment
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

ZIRCONIUM

Score: 4.47
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1583.006 - Web Services
MITREへのリンク →

APT32

Score: 10.68
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

APT28

Score: 30.00
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1040 - Network Sniffing
  • T1190 - Exploit Public-Facing Application
  • T1596 - Search Open Technical Databases
  • T1583.006 - Web Services
  • T1591 - Gather Victim Org Information
  • T1039 - Data from Network Shared Drive
  • T1203 - Exploitation for Client Execution
  • T1498 - Network Denial of Service
  • T1669 - Wi-Fi Networks
MITREへのリンク →

Star Blizzard

Score: 11.34
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1598.002 - Spearphishing Attachment
  • T1593 - Search Open Websites/Domains
MITREへのリンク →

CURIUM

Score: 6.08
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1584.006 - Web Services
MITREへのリンク →

Dragonfly

Score: 14.54
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1190 - Exploit Public-Facing Application
  • T1591.002 - Business Relationships
  • T1598.002 - Spearphishing Attachment
  • T1203 - Exploitation for Client Execution
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Patchwork

Score: 5.60
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1203 - Exploitation for Client Execution
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Velvet Ant

Score: 3.03
Matched TTPs:
  • T1040 - Network Sniffing
MITREへのリンク →

APT33

Score: 7.27
Matched TTPs:
  • T1040 - Network Sniffing
  • T1203 - Exploitation for Client Execution
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

DarkVishnya

Score: 3.03
Matched TTPs:
  • T1040 - Network Sniffing
MITREへのリンク →

TA2541

Score: 3.99
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.006 - Web Services
MITREへのリンク →

Earth Lusca

Score: 9.08
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1583.006 - Web Services
  • T1584.006 - Web Services
MITREへのリンク →

Mustard Tempest

Score: 6.51
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1608.006 - SEO Poisoning
MITREへのリンク →

LazyScripter

Score: 3.99
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.006 - Web Services
MITREへのリンク →

Gamaredon Group

Score: 7.02
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.006 - Web Services
  • T1039 - Data from Network Shared Drive
MITREへのリンク →

Threat Group-3390

Score: 9.07
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1608.002 - Upload Tool
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

SideCopy

Score: 9.73
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1598.002 - Spearphishing Attachment
  • T1614 - System Location Discovery
MITREへのリンク →

BlackByte

Score: 8.71
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1190 - Exploit Public-Facing Application
  • T1614.001 - System Language Discovery
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

BITTER

Score: 3.47
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

HEXANE

Score: 7.24
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1591.004 - Identify Roles
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Saint Bear

Score: 5.48
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

APT42

Score: 5.59
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1070 - Indicator Removal
MITREへのリンク →

Medusa Group

Score: 16.32
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1608.002 - Upload Tool
  • T1657 - Financial Theft
  • T1583.006 - Web Services
  • T1021.001 - Remote Desktop Protocol
  • T1218.014 - MMC
MITREへのリンク →

Storm-0501

Score: 7.61
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1657 - Financial Theft
  • T1614.001 - System Language Discovery
MITREへのリンク →

Fox Kitten

Score: 10.00
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1039 - Data from Network Shared Drive
  • T1021.001 - Remote Desktop Protocol
  • T1213.005 - Messaging Applications
MITREへのリンク →

Cinnamon Tempest

Score: 3.99
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1657 - Financial Theft
MITREへのリンク →

Agrius

Score: 3.12
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

menuPass

Score: 6.15
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1039 - Data from Network Shared Drive
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Blue Mockingbird

Score: 3.12
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Winter Vivern

Score: 5.09
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1584.006 - Web Services
MITREへのリンク →

Leviathan

Score: 4.61
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Volatile Cedar

Score: 5.60
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1595.003 - Wordlist Scanning
MITREへのリンク →

INC Ransom

Score: 5.64
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1657 - Financial Theft
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Axiom

Score: 12.77
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1584.005 - Botnet
  • T1203 - Exploitation for Client Execution
  • T1021.001 - Remote Desktop Protocol
  • T1001.002 - Steganography
MITREへのリンク →

APT41

Score: 12.88
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1203 - Exploitation for Client Execution
  • T1595.003 - Wordlist Scanning
  • T1021.001 - Remote Desktop Protocol
  • T1596.005 - Scan Databases
MITREへのリンク →

APT5

Score: 6.74
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1070 - Indicator Removal
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

MuddyWater

Score: 4.98
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

APT39

Score: 3.12
Matched TTPs:
  • T1190 - Exploit Public-Facing Application
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

MoustachedBouncer

Score: 4.54
Matched TTPs:
  • T1659 - Content Injection
MITREへのリンク →

Malteiro

Score: 6.14
Matched TTPs:
  • T1657 - Financial Theft
  • T1614.001 - System Language Discovery
MITREへのリンク →

Akira

Score: 4.17
Matched TTPs:
  • T1657 - Financial Theft
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Confucius

Score: 3.51
Matched TTPs:
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

BRONZE BUTLER

Score: 4.53
Matched TTPs:
  • T1039 - Data from Network Shared Drive
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Sowbug

Score: 3.03
Matched TTPs:
  • T1039 - Data from Network Shared Drive
MITREへのリンク →

Chimera

Score: 4.68
Matched TTPs:
  • T1039 - Data from Network Shared Drive
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

Cobalt Group

Score: 3.14
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

APT3

Score: 3.14
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1021.001 - Remote Desktop Protocol
MITREへのリンク →

FIN8

Score: 4.39
Matched TTPs:
  • T1021.001 - Remote Desktop Protocol
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

Wizard Spider

Score: 4.39
Matched TTPs:
  • T1021.001 - Remote Desktop Protocol
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

FIN6

Score: 4.39
Matched TTPs:
  • T1021.001 - Remote Desktop Protocol
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
MITREへのリンク →

PLATINUM

Score: 4.54
Matched TTPs:
  • T1056.004 - Credential API Hooking
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Volt Typhoon

Score: 0.84
Matched TTPs:
  • T1590.006 - Network Security Appliances
  • T1614 - System Location Discovery
  • T1021.001 - Remote Desktop Protocol
  • T1590.004 - Network Topology
  • T1592 - Gather Victim Host Information
  • T1591 - Gather Victim Org Information
  • T1594 - Search Victim-Owned Websites
  • T1590 - Gather Victim Network Information
  • T1584.005 - Botnet
  • T1593 - Search Open Websites/Domains
  • T1596.005 - Scan Databases
  • T1190 - Exploit Public-Facing Application
  • T1591.004 - Identify Roles
MITREへのリンク →

Sandworm Team

Score: 0.82
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1587.001 - Malware
  • T1491.002 - External Defacement
  • T1608.001 - Upload Malware
  • T1195 - Supply Chain Compromise
  • T1203 - Exploitation for Client Execution
  • T1591.002 - Business Relationships
  • T1040 - Network Sniffing
  • T1594 - Search Victim-Owned Websites
  • T1499 - Endpoint Denial of Service
  • T1584.005 - Botnet
  • T1593 - Search Open Websites/Domains
  • T1592.002 - Software
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

Kimsuky

Score: 0.73
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1021.001 - Remote Desktop Protocol
  • T1583.006 - Web Services
  • T1593.002 - Search Engines
  • T1657 - Financial Theft
  • T1040 - Network Sniffing
  • T1591 - Gather Victim Org Information
  • T1594 - Search Victim-Owned Websites
  • T1593.001 - Social Media
  • T1596 - Search Open Technical Databases
  • T1593 - Search Open Websites/Domains
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

APT28

Score: 0.62
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1498 - Network Denial of Service
  • T1039 - Data from Network Shared Drive
  • T1669 - Wi-Fi Networks
  • T1203 - Exploitation for Client Execution
  • T1583.006 - Web Services
  • T1040 - Network Sniffing
  • T1591 - Gather Victim Org Information
  • T1596 - Search Open Technical Databases
  • T1190 - Exploit Public-Facing Application
MITREへのリンク →

Contagious Interview

Score: 0.59
Matched TTPs:
  • T1587.001 - Malware
  • T1608.001 - Upload Malware
  • T1583.006 - Web Services
  • T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol
  • T1593.003 - Code Repositories
  • T1657 - Financial Theft
  • T1593.001 - Social Media
  • T1681 - Search Threat Vendor Data
  • T1593 - Search Open Websites/Domains
  • T1588.007 - Artificial Intelligence
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る