Trusted Design

Tracking Elirks Variants in Japan: Similarities to Previous Attacks

概要

Elirks, less widely known than PlugX, is a basic backdoor Trojan, first discovered in 2010, that is primarily used to steal information from compromised systems. We mostly observe attacks using Elirks occurring in East Asia. One of the unique features of the malware is that it retrieves its C2 address by accessing a pre-determined microblog service or SNS. Attackers create accounts on those services and post encoded IP addresses or the domain names of real C2 servers in advance of distributing the backdoor. We have seen multiple Elirks variants using Japanese blog services for the last couple of years. Figure 1 shows embedded URL in an Elirks sample found in early 2016.

Created: 2026-02-23

Indicators

類似Pulses

このPulseに関連する脅威アクター (事実ベース)

Ember Bear

Score: 5.63
Matched TTPs:
  • T1491.002 - External Defacement
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Sandworm Team

Score: 21.10
Matched TTPs:
  • T1491.002 - External Defacement
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1589.002 - Email Addresses
  • T1593 - Search Open Websites/Domains
  • T1102.002 - Bidirectional Communication
  • T1203 - Exploitation for Client Execution
  • T1584.004 - Server
MITREへのリンク →

APT41

Score: 14.29
Matched TTPs:
  • T1069 - Permission Groups Discovery
  • T1036.004 - Masquerade Task or Service
  • T1203 - Exploitation for Client Execution
  • T1595.003 - Wordlist Scanning
  • T1102.001 - Dead Drop Resolver
MITREへのリンク →

Scattered Spider

Score: 13.43
Matched TTPs:
  • T1069 - Permission Groups Discovery
  • T1598.003 - Spearphishing Link
  • T1087 - Account Discovery
  • T1136 - Create Account
MITREへのリンク →

TA505

Score: 5.26
Matched TTPs:
  • T1069 - Permission Groups Discovery
  • T1608.001 - Upload Malware
MITREへのリンク →

Volt Typhoon

Score: 11.93
Matched TTPs:
  • T1069 - Permission Groups Discovery
  • T1589.002 - Email Addresses
  • T1593 - Search Open Websites/Domains
  • T1584.004 - Server
MITREへのリンク →

APT3

Score: 11.15
Matched TTPs:
  • T1069 - Permission Groups Discovery
  • T1090.002 - External Proxy
  • T1203 - Exploitation for Client Execution
  • T1036.010 - Masquerade Account Name
MITREへのリンク →

FIN13

Score: 9.23
Matched TTPs:
  • T1069 - Permission Groups Discovery
  • T1087 - Account Discovery
  • T1036.004 - Masquerade Task or Service
MITREへのリンク →

Sidewinder

Score: 3.95
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Mustang Panda

Score: 21.03
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1102 - Web Service
  • T1583.006 - Web Services
  • T1593 - Search Open Websites/Domains
  • T1203 - Exploitation for Client Execution
  • T1588.003 - Code Signing Certificates
  • T1027.007 - Dynamic API Resolution
MITREへのリンク →

Silent Librarian

Score: 4.98
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1589.002 - Email Addresses
MITREへのリンク →

ZIRCONIUM

Score: 8.96
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1036.004 - Masquerade Task or Service
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

APT32

Score: 23.36
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1589.002 - Email Addresses
  • T1550.003 - Pass the Ticket
  • T1036.004 - Masquerade Task or Service
  • T1102 - Web Service
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
  • T1078.003 - Local Accounts
MITREへのリンク →

Kimsuky

Score: 29.13
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1589.002 - Email Addresses
  • T1036.004 - Masquerade Task or Service
  • T1583.006 - Web Services
  • T1593 - Search Open Websites/Domains
  • T1102.002 - Bidirectional Communication
  • T1588.003 - Code Signing Certificates
  • T1102.001 - Dead Drop Resolver
  • T1584.001 - Domains
  • T1078.003 - Local Accounts
MITREへのリンク →

Magic Hound

Score: 20.16
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1589.002 - Email Addresses
  • T1036.004 - Masquerade Task or Service
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1036.010 - Masquerade Account Name
  • T1189 - Drive-by Compromise
  • T1584.001 - Domains
MITREへのリンク →

APT28

Score: 21.95
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1090.002 - External Proxy
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
  • T1498 - Network Denial of Service
  • T1669 - Wi-Fi Networks
MITREへのリンク →

Star Blizzard

Score: 7.72
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1593 - Search Open Websites/Domains
MITREへのリンク →

Moonstone Sleet

Score: 6.95
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1589.002 - Email Addresses
MITREへのリンク →

CURIUM

Score: 7.85
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1584.006 - Web Services
  • T1189 - Drive-by Compromise
MITREへのリンク →

Dragonfly

Score: 12.17
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1203 - Exploitation for Client Execution
  • T1036.010 - Masquerade Account Name
  • T1189 - Drive-by Compromise
  • T1584.004 - Server
MITREへのリンク →

Patchwork

Score: 9.00
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
  • T1102.001 - Dead Drop Resolver
MITREへのリンク →

TA2541

Score: 6.73
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.006 - Web Services
  • T1573.002 - Asymmetric Cryptography
MITREへのリンク →

Earth Lusca

Score: 12.21
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.006 - Web Services
  • T1584.006 - Web Services
  • T1189 - Drive-by Compromise
  • T1584.004 - Server
MITREへのリンク →

Mustard Tempest

Score: 7.02
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1189 - Drive-by Compromise
  • T1584.001 - Domains
MITREへのリンク →

OilRig

Score: 13.90
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
  • T1137.004 - Outlook Home Page
  • T1573.002 - Asymmetric Cryptography
  • T1588.003 - Code Signing Certificates
MITREへのリンク →

TeamTNT

Score: 4.50
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1102 - Web Service
MITREへのリンク →

LazyScripter

Score: 6.51
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1102 - Web Service
  • T1583.006 - Web Services
MITREへのリンク →

Gamaredon Group

Score: 16.88
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1102 - Web Service
  • T1583.006 - Web Services
  • T1491.001 - Internal Defacement
  • T1102.003 - One-Way Communication
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

Threat Group-3390

Score: 8.38
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
  • T1588.003 - Code Signing Certificates
MITREへのリンク →

SideCopy

Score: 5.26
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1584.001 - Domains
MITREへのリンク →

BlackByte

Score: 5.82
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1491.001 - Internal Defacement
MITREへのリンク →

BITTER

Score: 5.56
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1036.004 - Masquerade Task or Service
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

HEXANE

Score: 6.89
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1589.002 - Email Addresses
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

Saint Bear

Score: 8.00
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1589.002 - Email Addresses
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Contagious Interview

Score: 11.81
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1583.006 - Web Services
  • T1593 - Search Open Websites/Domains
  • T1204.004 - Malicious Copy and Paste
MITREへのリンク →

FIN7

Score: 11.14
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1036.004 - Masquerade Task or Service
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1078.003 - Local Accounts
MITREへのリンク →

EXOTIC LILY

Score: 8.51
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1589.002 - Email Addresses
  • T1102 - Web Service
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

APT42

Score: 7.24
Matched TTPs:
  • T1608.001 - Upload Malware
  • T1102 - Web Service
  • T1573.002 - Asymmetric Cryptography
MITREへのリンク →

MoustachedBouncer

Score: 4.54
Matched TTPs:
  • T1659 - Content Injection
MITREへのリンク →

APT39

Score: 5.14
Matched TTPs:
  • T1090.002 - External Proxy
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

Tonto Team

Score: 4.24
Matched TTPs:
  • T1090.002 - External Proxy
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Lazarus Group

Score: 29.47
Matched TTPs:
  • T1090.002 - External Proxy
  • T1589.002 - Email Addresses
  • T1036.004 - Masquerade Task or Service
  • T1583.006 - Web Services
  • T1491.001 - Internal Defacement
  • T1102.002 - Bidirectional Communication
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
  • T1584.004 - Server
  • T1027.007 - Dynamic API Resolution
  • T1529 - System Shutdown/Reboot
MITREへのリンク →

APT29

Score: 12.76
Matched TTPs:
  • T1090.002 - External Proxy
  • T1550.003 - Pass the Ticket
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
  • T1078.003 - Local Accounts
MITREへのリンク →

MuddyWater

Score: 8.65
Matched TTPs:
  • T1090.002 - External Proxy
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Winter Vivern

Score: 12.02
Matched TTPs:
  • T1056.003 - Web Portal Capture
  • T1036.004 - Masquerade Task or Service
  • T1584.006 - Web Services
  • T1189 - Drive-by Compromise
MITREへのリンク →

HAFNIUM

Score: 7.20
Matched TTPs:
  • T1589.002 - Email Addresses
  • T1583.006 - Web Services
  • T1078.003 - Local Accounts
MITREへのリンク →

Aquatic Panda

Score: 5.94
Matched TTPs:
  • T1087 - Account Discovery
  • T1036.004 - Masquerade Task or Service
MITREへのリンク →

BRONZE BUTLER

Score: 10.39
Matched TTPs:
  • T1550.003 - Pass the Ticket
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
  • T1102.001 - Dead Drop Resolver
MITREへのリンク →

Carbanak

Score: 4.49
Matched TTPs:
  • T1036.004 - Masquerade Task or Service
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

Wizard Spider

Score: 5.25
Matched TTPs:
  • T1036.004 - Masquerade Task or Service
  • T1588.003 - Code Signing Certificates
MITREへのリンク →

FIN6

Score: 7.36
Matched TTPs:
  • T1036.004 - Masquerade Task or Service
  • T1102 - Web Service
  • T1573.002 - Asymmetric Cryptography
MITREへのリンク →

Fox Kitten

Score: 4.62
Matched TTPs:
  • T1036.004 - Masquerade Task or Service
  • T1102 - Web Service
MITREへのリンク →

PROMETHIUM

Score: 6.53
Matched TTPs:
  • T1036.004 - Masquerade Task or Service
  • T1189 - Drive-by Compromise
  • T1078.003 - Local Accounts
MITREへのリンク →

UNC3886

Score: 3.59
Matched TTPs:
  • T1036.004 - Masquerade Task or Service
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Higaisa

Score: 3.59
Matched TTPs:
  • T1036.004 - Masquerade Task or Service
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

RedCurl

Score: 5.27
Matched TTPs:
  • T1102 - Web Service
  • T1573.002 - Asymmetric Cryptography
MITREへのリンク →

Inception

Score: 4.02
Matched TTPs:
  • T1102 - Web Service
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Rocke

Score: 5.81
Matched TTPs:
  • T1102 - Web Service
  • T1102.001 - Dead Drop Resolver
MITREへのリンク →

FIN8

Score: 8.42
Matched TTPs:
  • T1102 - Web Service
  • T1573.002 - Asymmetric Cryptography
  • T1588.003 - Code Signing Certificates
MITREへのリンク →

Turla

Score: 17.82
Matched TTPs:
  • T1102 - Web Service
  • T1583.006 - Web Services
  • T1584.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1189 - Drive-by Compromise
  • T1584.004 - Server
  • T1078.003 - Local Accounts
MITREへのリンク →

Medusa Group

Score: 8.38
Matched TTPs:
  • T1583.006 - Web Services
  • T1573.002 - Asymmetric Cryptography
  • T1529 - System Shutdown/Reboot
MITREへのリンク →

Confucius

Score: 3.51
Matched TTPs:
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

POLONIUM

Score: 4.41
Matched TTPs:
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

Leviathan

Score: 10.22
Matched TTPs:
  • T1102.003 - One-Way Communication
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
  • T1584.004 - Server
MITREへのリンク →

APT37

Score: 9.28
Matched TTPs:
  • T1102.002 - Bidirectional Communication
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
  • T1529 - System Shutdown/Reboot
MITREへのリンク →

APT12

Score: 3.89
Matched TTPs:
  • T1102.002 - Bidirectional Communication
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Andariel

Score: 3.26
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
MITREへのリンク →

BlackTech

Score: 4.65
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1588.003 - Code Signing Certificates
MITREへのリンク →

Axiom

Score: 7.80
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
  • T1001.002 - Steganography
MITREへのリンク →

Cobalt Group

Score: 4.24
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1573.002 - Asymmetric Cryptography
MITREへのリンク →

Sea Turtle

Score: 4.16
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1078.003 - Local Accounts
MITREへのリンク →

Transparent Tribe

Score: 6.54
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
  • T1584.001 - Domains
MITREへのリンク →

Tropic Trooper

Score: 6.91
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1573.002 - Asymmetric Cryptography
  • T1078.003 - Local Accounts
MITREへのリンク →

Elderwood

Score: 3.26
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
MITREへのリンク →

Darkhotel

Score: 3.26
Matched TTPs:
  • T1203 - Exploitation for Client Execution
  • T1189 - Drive-by Compromise
MITREへのリンク →

Volatile Cedar

Score: 4.13
Matched TTPs:
  • T1595.003 - Wordlist Scanning
MITREへのリンク →

Storm-1811

Score: 8.16
Matched TTPs:
  • T1667 - Email Bombing
  • T1036.010 - Masquerade Account Name
MITREへのリンク →

Velvet Ant

Score: 5.41
Matched TTPs:
  • T1573.002 - Asymmetric Cryptography
  • T1078.003 - Local Accounts
MITREへのリンク →

RTM

Score: 5.05
Matched TTPs:
  • T1189 - Drive-by Compromise
  • T1102.001 - Dead Drop Resolver
MITREへのリンク →

APT38

Score: 5.39
Matched TTPs:
  • T1189 - Drive-by Compromise
  • T1529 - System Shutdown/Reboot
MITREへのリンク →

Daggerfly

Score: 4.60
Matched TTPs:
  • T1189 - Drive-by Compromise
  • T1584.004 - Server
MITREへのリンク →

Equation

Score: 4.13
Matched TTPs:
  • T1564.005 - Hidden File System
MITREへのリンク →

Strider

Score: 4.13
Matched TTPs:
  • T1564.005 - Hidden File System
MITREへのリンク →

Indrik Spider

Score: 6.68
Matched TTPs:
  • T1136 - Create Account
  • T1584.004 - Server
MITREへのリンク →

Salt Typhoon

Score: 3.84
Matched TTPs:
  • T1136 - Create Account
MITREへのリンク →

APT1

Score: 3.29
Matched TTPs:
  • T1584.001 - Domains
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Lazarus Group

Score: 0.81
Matched TTPs:
  • T1189 - Drive-by Compromise
  • T1491.001 - Internal Defacement
  • T1589.002 - Email Addresses
  • T1036.004 - Masquerade Task or Service
  • T1203 - Exploitation for Client Execution
  • T1529 - System Shutdown/Reboot
  • T1027.007 - Dynamic API Resolution
  • T1090.002 - External Proxy
  • T1584.004 - Server
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

Kimsuky

Score: 0.81
Matched TTPs:
  • T1102.001 - Dead Drop Resolver
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1589.002 - Email Addresses
  • T1036.004 - Masquerade Task or Service
  • T1588.003 - Code Signing Certificates
  • T1078.003 - Local Accounts
  • T1584.001 - Domains
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
  • T1593 - Search Open Websites/Domains
MITREへのリンク →

APT32

Score: 0.67
Matched TTPs:
  • T1550.003 - Pass the Ticket
  • T1598.003 - Spearphishing Link
  • T1189 - Drive-by Compromise
  • T1608.001 - Upload Malware
  • T1589.002 - Email Addresses
  • T1036.004 - Masquerade Task or Service
  • T1102 - Web Service
  • T1078.003 - Local Accounts
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

APT28

Score: 0.63
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1189 - Drive-by Compromise
  • T1498 - Network Denial of Service
  • T1102.002 - Bidirectional Communication
  • T1090.002 - External Proxy
  • T1669 - Wi-Fi Networks
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
MITREへのリンク →

Mustang Panda

Score: 0.61
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1588.003 - Code Signing Certificates
  • T1027.007 - Dynamic API Resolution
  • T1102 - Web Service
  • T1583.006 - Web Services
  • T1203 - Exploitation for Client Execution
  • T1593 - Search Open Websites/Domains
MITREへのリンク →

Sandworm Team

Score: 0.61
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1608.001 - Upload Malware
  • T1589.002 - Email Addresses
  • T1491.002 - External Defacement
  • T1203 - Exploitation for Client Execution
  • T1584.004 - Server
  • T1102.002 - Bidirectional Communication
  • T1593 - Search Open Websites/Domains
MITREへのリンク →

Magic Hound

Score: 0.57
Matched TTPs:
  • T1036.010 - Masquerade Account Name
  • T1598.003 - Spearphishing Link
  • T1189 - Drive-by Compromise
  • T1589.002 - Email Addresses
  • T1036.004 - Masquerade Task or Service
  • T1584.001 - Domains
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

Turla

Score: 0.56
Matched TTPs:
  • T1189 - Drive-by Compromise
  • T1584.006 - Web Services
  • T1102 - Web Service
  • T1078.003 - Local Accounts
  • T1584.004 - Server
  • T1583.006 - Web Services
  • T1102.002 - Bidirectional Communication
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る