Trusted Design

ClickFix Removes Your Background but Leaves the Malware

概要

BackgroundFix masquerades as a free image-editing tool but functions as a ClickFix social engineering lure. The fake service prompts users to verify they are human, copying malicious commands to their clipboard that invoke finger.exe to retrieve additional payloads. This chain delivers CastleLoader, which subsequently drops NetSupport RAT and a custom .NET stealer dubbed CastleStealer. The loader uses reflective PE injection, API hashing, and ChaCha20-encrypted C2 communications. CastleStealer targets browser credentials, cryptocurrency wallet extensions, and Telegram sessions through DPAPI decryption and Restart Manager APIs. The campaign leverages BYOI tactics with embedded Python interpreters and multiple shellcode stages. A notable implementation flaw exists where launch method 4 references regsrv32.exe instead of the correct regsvr32.exe, causing silent failures.

Created: 2026-05-04

Indicators

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

HAFNIUM

Score: 4.34
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
MITREへのリンク →

menuPass

Score: 12.96
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1527 - Application Access Token
  • T1558 - Steal or Forge Kerberos Tickets
  • T1547.011 - Plist Modification
MITREへのリンク →

Wizard Spider

Score: 17.49
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1183 - Image File Execution Options Injection
  • T1083 - File and Directory Discovery
  • T1087.004 - Cloud Account
  • T1597 - Search Closed Sources
  • T1556.009 - Conditional Access Policies
MITREへのリンク →

APT33

Score: 5.48
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1562.001 - Disable or Modify Tools
  • T1218.010 - Regsvr32
MITREへのリンク →

Fox Kitten

Score: 8.32
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1177 - LSASS Driver
  • T1656 - Impersonation
MITREへのリンク →

Volt Typhoon

Score: 40.53
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1560.003 - Archive via Custom Method
  • T1562.009 - Safe Mode Boot
  • T1003.007 - Proc Filesystem
  • T1556.002 - Password Filter DLL
  • T1547.005 - Security Support Provider
  • T1083 - File and Directory Discovery
  • T1584.002 - DNS Server
  • T1065 - Uncommonly Used Port
  • T1159 - Launch Agent
  • T1665 - Hide Infrastructure
  • T1569.002 - Service Execution
MITREへのリンク →

APT1

Score: 6.40
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1003.007 - Proc Filesystem
  • T1183 - Image File Execution Options Injection
MITREへのリンク →

Mustang Panda

Score: 27.80
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1183 - Image File Execution Options Injection
  • T1087.004 - Cloud Account
  • T1169 - Sudo
  • T1136.003 - Cloud Account
  • T1218.010 - Regsvr32
  • T1565.002 - Transmitted Data Manipulation
  • T1159 - Launch Agent
  • T1055.005 - Thread Local Storage
MITREへのリンク →

Play

Score: 6.83
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1597 - Search Closed Sources
  • T1574.009 - Path Interception by Unquoted Path
MITREへのリンク →

Chimera

Score: 8.92
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1003.007 - Proc Filesystem
  • T1087.004 - Cloud Account
  • T1665 - Hide Infrastructure
MITREへのリンク →

Sea Turtle

Score: 3.09
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1218.010 - Regsvr32
MITREへのリンク →

APT39

Score: 11.58
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1547.011 - Plist Modification
  • T1087.004 - Cloud Account
  • T1027.004 - Compile After Delivery
  • T1569.002 - Service Execution
MITREへのリンク →

RedCurl

Score: 17.03
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1591.003 - Identify Business Tempo
  • T1016.002 - Wi-Fi Discovery
  • T1090 - Proxy
  • T1128 - Netsh Helper DLL
  • T1027.004 - Compile After Delivery
MITREへのリンク →

APT5

Score: 4.19
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
MITREへのリンク →

Agrius

Score: 10.14
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1558 - Steal or Forge Kerberos Tickets
  • T1087.004 - Cloud Account
  • T1597 - Search Closed Sources
MITREへのリンク →

GALLIUM

Score: 8.90
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1547.011 - Plist Modification
  • T1087.004 - Cloud Account
MITREへのリンク →

APT41

Score: 18.03
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1560.003 - Archive via Custom Method
  • T1584.008 - Network Devices
  • T1177 - LSASS Driver
  • T1027 - Obfuscated Files or Information
  • T1218.010 - Regsvr32
  • T1574.009 - Path Interception by Unquoted Path
MITREへのリンク →

MuddyWater

Score: 16.66
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
  • T1087.004 - Cloud Account
  • T1597 - Search Closed Sources
  • T1218.010 - Regsvr32
  • T1027.004 - Compile After Delivery
  • T1159 - Launch Agent
MITREへのリンク →

APT28

Score: 25.94
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1222.002 - Linux and Mac Permissions
  • T1586.003 - Cloud Accounts
  • T1558 - Steal or Forge Kerberos Tickets
  • T1131 - Authentication Package
  • T1547.011 - Plist Modification
  • T1218.010 - Regsvr32
  • T1574.009 - Path Interception by Unquoted Path
  • T1197 - BITS Jobs
MITREへのリンク →

Turla

Score: 22.81
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1099 - Timestomp
  • T1003.007 - Proc Filesystem
  • T1131 - Authentication Package
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1556.009 - Conditional Access Policies
  • T1569.002 - Service Execution
MITREへのリンク →

BRONZE BUTLER

Score: 25.81
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1591.003 - Identify Business Tempo
  • T1003.007 - Proc Filesystem
  • T1558 - Steal or Forge Kerberos Tickets
  • T1592.004 - Client Configurations
  • T1597 - Search Closed Sources
  • T1218.010 - Regsvr32
  • T1027.004 - Compile After Delivery
  • T1159 - Launch Agent
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

UNC3886

Score: 17.83
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1556.002 - Password Filter DLL
  • T1009 - Binary Padding
  • T1021.006 - Windows Remote Management
  • T1597 - Search Closed Sources
  • T1218.010 - Regsvr32
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Kimsuky

Score: 51.17
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1213.006 - Databases
  • T1003.007 - Proc Filesystem
  • T1009 - Binary Padding
  • T1131 - Authentication Package
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
  • T1087.004 - Cloud Account
  • T1597 - Search Closed Sources
  • T1027.014 - Polymorphic Code
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1656 - Impersonation
  • T1565.002 - Transmitted Data Manipulation
  • T1126 - Network Share Connection Removal
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT3

Score: 14.38
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1560.003 - Archive via Custom Method
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1087.004 - Cloud Account
  • T1218.010 - Regsvr32
MITREへのリンク →

FIN8

Score: 9.43
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1027 - Obfuscated Files or Information
  • T1128 - Netsh Helper DLL
MITREへのリンク →

Ke3chang

Score: 16.50
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1003.007 - Proc Filesystem
  • T1198 - SIP and Trust Provider Hijacking
  • T1090 - Proxy
  • T1087.004 - Cloud Account
MITREへのリンク →

Lotus Blossom

Score: 7.27
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1569.002 - Service Execution
MITREへのリンク →

FIN13

Score: 22.39
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1560.003 - Archive via Custom Method
  • T1584.008 - Network Devices
  • T1558 - Steal or Forge Kerberos Tickets
  • T1547.005 - Security Support Provider
  • T1134.001 - Token Impersonation/Theft
  • T1569.002 - Service Execution
MITREへのリンク →

Earth Lusca

Score: 12.28
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1003.007 - Proc Filesystem
  • T1110.003 - Password Spraying
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Magic Hound

Score: 25.67
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1586.003 - Cloud Accounts
  • T1016.002 - Wi-Fi Discovery
  • T1547.005 - Security Support Provider
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Aquatic Panda

Score: 5.91
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1003.007 - Proc Filesystem
  • T1597 - Search Closed Sources
MITREへのリンク →

INC Ransom

Score: 9.35
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1083 - File and Directory Discovery
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Akira

Score: 10.27
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1137.005 - Outlook Rules
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

ToddyCat

Score: 6.77
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1009 - Binary Padding
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT29

Score: 31.56
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1202 - Indirect Command Execution
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1592.004 - Client Configurations
  • T1556.008 - Network Provider DLL
  • T1218.010 - Regsvr32
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Scattered Spider

Score: 37.86
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
  • T1560.003 - Archive via Custom Method
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1547.005 - Security Support Provider
  • T1609 - Container Administration Command
  • T1083 - File and Directory Discovery
  • T1087.004 - Cloud Account
  • T1556.008 - Network Provider DLL
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1197 - BITS Jobs
  • T1565.002 - Transmitted Data Manipulation
MITREへのリンク →

FIN4

Score: 4.13
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
MITREへのリンク →

APT32

Score: 25.86
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1115 - Clipboard Data
  • T1558 - Steal or Forge Kerberos Tickets
  • T1547.005 - Security Support Provider
  • T1131 - Authentication Package
  • T1592.004 - Client Configurations
  • T1087.004 - Cloud Account
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
  • T1218.010 - Regsvr32
MITREへのリンク →

Saint Bear

Score: 5.26
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1597 - Search Closed Sources
  • T1218.010 - Regsvr32
MITREへのリンク →

FIN6

Score: 6.52
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1597 - Search Closed Sources
  • T1128 - Netsh Helper DLL
MITREへのリンク →

Sidewinder

Score: 9.50
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1090 - Proxy
  • T1218.010 - Regsvr32
  • T1159 - Launch Agent
MITREへのリンク →

Winter Vivern

Score: 9.42
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1558 - Steal or Forge Kerberos Tickets
  • T1090 - Proxy
  • T1087.004 - Cloud Account
MITREへのリンク →

Silence

Score: 7.12
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Contagious Interview

Score: 39.14
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1586.003 - Cloud Accounts
  • T1558 - Steal or Forge Kerberos Tickets
  • T1547.005 - Security Support Provider
  • T1131 - Authentication Package
  • T1021.006 - Windows Remote Management
  • T1183 - Image File Execution Options Injection
  • T1087.004 - Cloud Account
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027.004 - Compile After Delivery
  • T1656 - Impersonation
  • T1565.002 - Transmitted Data Manipulation
  • T1126 - Network Share Connection Removal
MITREへのリンク →

LazyScripter

Score: 4.16
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1558 - Steal or Forge Kerberos Tickets
MITREへのリンク →

TA505

Score: 16.86
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1560.003 - Archive via Custom Method
  • T1527 - Application Access Token
  • T1016.002 - Wi-Fi Discovery
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

FIN7

Score: 15.71
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1115 - Clipboard Data
  • T1009 - Binary Padding
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1065 - Uncommonly Used Port
MITREへのリンク →

Cobalt Group

Score: 13.50
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1598.004 - Spearphishing Voice
  • T1027.014 - Polymorphic Code
  • T1218.010 - Regsvr32
  • T1128 - Netsh Helper DLL
MITREへのリンク →

Higaisa

Score: 11.20
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1087.004 - Cloud Account
  • T1218.010 - Regsvr32
  • T1665 - Hide Infrastructure
  • T1569.002 - Service Execution
MITREへのリンク →

Indrik Spider

Score: 10.92
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1003.007 - Proc Filesystem
  • T1183 - Image File Execution Options Injection
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Evilnum

Score: 8.34
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1562.009 - Safe Mode Boot
  • T1565.002 - Transmitted Data Manipulation
MITREへのリンク →

Star Blizzard

Score: 10.63
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1609 - Container Administration Command
MITREへのリンク →

HEXANE

Score: 14.33
Matched TTPs:
  • T1099 - Timestomp
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1065 - Uncommonly Used Port
  • T1159 - Launch Agent
MITREへのリンク →

Gamaredon Group

Score: 35.73
Matched TTPs:
  • T1099 - Timestomp
  • T1591.003 - Identify Business Tempo
  • T1527 - Application Access Token
  • T1562.009 - Safe Mode Boot
  • T1090 - Proxy
  • T1087.004 - Cloud Account
  • T1554 - Compromise Host Software Binary
  • T1597 - Search Closed Sources
  • T1061 - Graphical User Interface
  • T1562.001 - Disable or Modify Tools
  • T1086 - PowerShell
MITREへのリンク →

TA2541

Score: 7.29
Matched TTPs:
  • T1099 - Timestomp
  • T1597 - Search Closed Sources
  • T1128 - Netsh Helper DLL
MITREへのリンク →

Mustard Tempest

Score: 7.57
Matched TTPs:
  • T1682 - Query Public AI Services
  • T1115 - Clipboard Data
MITREへのリンク →

Daggerfly

Score: 6.44
Matched TTPs:
  • T1584.008 - Network Devices
  • T1530 - Data from Cloud Storage
MITREへのリンク →

Dragonfly

Score: 15.93
Matched TTPs:
  • T1584.008 - Network Devices
  • T1115 - Clipboard Data
  • T1009 - Binary Padding
  • T1531 - Account Access Removal
  • T1218.010 - Regsvr32
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Threat Group-3390

Score: 14.40
Matched TTPs:
  • T1584.008 - Network Devices
  • T1115 - Clipboard Data
  • T1218.010 - Regsvr32
  • T1574.009 - Path Interception by Unquoted Path
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

Ember Bear

Score: 13.91
Matched TTPs:
  • T1584.008 - Network Devices
  • T1558 - Steal or Forge Kerberos Tickets
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1218.010 - Regsvr32
  • T1656 - Impersonation
MITREへのリンク →

Darkhotel

Score: 8.37
Matched TTPs:
  • T1591.003 - Identify Business Tempo
  • T1562.009 - Safe Mode Boot
  • T1218.010 - Regsvr32
MITREへのリンク →

Cinnamon Tempest

Score: 5.78
Matched TTPs:
  • T1591.003 - Identify Business Tempo
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Storm-0501

Score: 12.15
Matched TTPs:
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1027 - Obfuscated Files or Information
  • T1027.014 - Polymorphic Code
  • T1565.002 - Transmitted Data Manipulation
MITREへのリンク →

Sandworm Team

Score: 28.82
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1558 - Steal or Forge Kerberos Tickets
  • T1016.002 - Wi-Fi Discovery
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1087.004 - Cloud Account
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1218.010 - Regsvr32
  • T1075 - Pass the Hash
MITREへのリンク →

Leviathan

Score: 16.76
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1183 - Image File Execution Options Injection
  • T1087.004 - Cloud Account
  • T1554 - Compromise Host Software Binary
  • T1027.014 - Polymorphic Code
  • T1218.010 - Regsvr32
MITREへのリンク →

OilRig

Score: 18.35
Matched TTPs:
  • T1562.009 - Safe Mode Boot
  • T1003.007 - Proc Filesystem
  • T1558 - Steal or Forge Kerberos Tickets
  • T1009 - Binary Padding
  • T1218.010 - Regsvr32
  • T1128 - Netsh Helper DLL
  • T1556.009 - Conditional Access Policies
MITREへのリンク →

Transparent Tribe

Score: 4.53
Matched TTPs:
  • T1115 - Clipboard Data
  • T1218.010 - Regsvr32
MITREへのリンク →

LuminousMoth

Score: 8.45
Matched TTPs:
  • T1115 - Clipboard Data
  • T1087.004 - Cloud Account
  • T1574.009 - Path Interception by Unquoted Path
MITREへのリンク →

CURIUM

Score: 7.29
Matched TTPs:
  • T1115 - Clipboard Data
  • T1183 - Image File Execution Options Injection
  • T1087.004 - Cloud Account
MITREへのリンク →

TeamTNT

Score: 15.53
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1558 - Steal or Forge Kerberos Tickets
  • T1009 - Binary Padding
  • T1110.003 - Password Spraying
  • T1597 - Search Closed Sources
  • T1665 - Hide Infrastructure
MITREへのリンク →

admin@338

Score: 4.02
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1218.010 - Regsvr32
MITREへのリンク →

PROMETHIUM

Score: 3.84
Matched TTPs:
  • T1530 - Data from Cloud Storage
MITREへのリンク →

Patchwork

Score: 8.17
Matched TTPs:
  • T1530 - Data from Cloud Storage
  • T1218.010 - Regsvr32
  • T1665 - Hide Infrastructure
MITREへのリンク →

BlackByte

Score: 16.21
Matched TTPs:
  • T1586.003 - Cloud Accounts
  • T1009 - Binary Padding
  • T1134.001 - Token Impersonation/Theft
  • T1087.004 - Cloud Account
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Aoqin Dragon

Score: 3.68
Matched TTPs:
  • T1558 - Steal or Forge Kerberos Tickets
  • T1218.010 - Regsvr32
MITREへのリンク →

ZIRCONIUM

Score: 9.94
Matched TTPs:
  • T1558 - Steal or Forge Kerberos Tickets
  • T1087.004 - Cloud Account
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
MITREへのリンク →

Windshift

Score: 4.93
Matched TTPs:
  • T1558 - Steal or Forge Kerberos Tickets
  • T1159 - Launch Agent
MITREへのリンク →

Storm-1811

Score: 11.99
Matched TTPs:
  • T1558 - Steal or Forge Kerberos Tickets
  • T1027 - Obfuscated Files or Information
  • T1486 - Data Encrypted for Impact
  • T1565.002 - Transmitted Data Manipulation
MITREへのリンク →

TA551

Score: 4.93
Matched TTPs:
  • T1558 - Steal or Forge Kerberos Tickets
  • T1027.014 - Polymorphic Code
MITREへのリンク →

LAPSUS$

Score: 13.83
Matched TTPs:
  • T1547.005 - Security Support Provider
  • T1609 - Container Administration Command
  • T1556.008 - Network Provider DLL
  • T1065 - Uncommonly Used Port
MITREへのリンク →

Salt Typhoon

Score: 6.19
Matched TTPs:
  • T1009 - Binary Padding
  • T1110.003 - Password Spraying
MITREへのリンク →

Rocke

Score: 8.88
Matched TTPs:
  • T1009 - Binary Padding
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Medusa Group

Score: 11.51
Matched TTPs:
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1128 - Netsh Helper DLL
MITREへのリンク →

Lazarus Group

Score: 33.60
Matched TTPs:
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1547.011 - Plist Modification
  • T1087.004 - Cloud Account
  • T1069.001 - Local Groups
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1218.010 - Regsvr32
  • T1055.005 - Thread Local Storage
  • T1665 - Hide Infrastructure
  • T1569.002 - Service Execution
  • T1086 - PowerShell
MITREへのリンク →

APT38

Score: 15.55
Matched TTPs:
  • T1009 - Binary Padding
  • T1590 - Gather Victim Network Information
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1493 - Transmitted Data Manipulation
MITREへのリンク →

Velvet Ant

Score: 12.21
Matched TTPs:
  • T1009 - Binary Padding
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1128 - Netsh Helper DLL
  • T1569.002 - Service Execution
MITREへのリンク →

SilverTerrier

Score: 3.29
Matched TTPs:
  • T1131 - Authentication Package
MITREへのリンク →

Moonstone Sleet

Score: 11.91
Matched TTPs:
  • T1183 - Image File Execution Options Injection
  • T1027 - Obfuscated Files or Information
  • T1197 - BITS Jobs
  • T1126 - Network Share Connection Removal
MITREへのリンク →

APT42

Score: 5.03
Matched TTPs:
  • T1183 - Image File Execution Options Injection
  • T1128 - Netsh Helper DLL
MITREへのリンク →

Silent Librarian

Score: 9.57
Matched TTPs:
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
MITREへのリンク →

EXOTIC LILY

Score: 3.78
Matched TTPs:
  • T1183 - Image File Execution Options Injection
  • T1218.010 - Regsvr32
MITREへのリンク →

Tonto Team

Score: 6.58
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1218.010 - Regsvr32
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Deep Panda

Score: 6.03
Matched TTPs:
  • T1177 - LSASS Driver
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Axiom

Score: 9.32
Matched TTPs:
  • T1177 - LSASS Driver
  • T1218.010 - Regsvr32
  • T1160 - Launch Daemon
MITREへのリンク →

Tropic Trooper

Score: 17.24
Matched TTPs:
  • T1090 - Proxy
  • T1136.003 - Cloud Account
  • T1218.010 - Regsvr32
  • T1128 - Netsh Helper DLL
  • T1159 - Launch Agent
  • T1665 - Hide Infrastructure
MITREへのリンク →

Confucius

Score: 6.30
Matched TTPs:
  • T1087.004 - Cloud Account
  • T1218.010 - Regsvr32
  • T1665 - Hide Infrastructure
MITREへのリンク →

Stealth Falcon

Score: 5.59
Matched TTPs:
  • T1087.004 - Cloud Account
  • T1556.009 - Conditional Access Policies
MITREへのリンク →

WIRTE

Score: 5.14
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
MITREへのリンク →

RedEcho

Score: 5.14
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1128 - Netsh Helper DLL
MITREへのリンク →

DarkHydrus

Score: 4.13
Matched TTPs:
  • T1531 - Account Access Removal
MITREへのリンク →

Inception

Score: 6.99
Matched TTPs:
  • T1027.014 - Polymorphic Code
  • T1218.010 - Regsvr32
  • T1159 - Launch Agent
MITREへのリンク →

APT37

Score: 3.83
Matched TTPs:
  • T1218.010 - Regsvr32
  • T1027.004 - Compile After Delivery
MITREへのリンク →

SideCopy

Score: 6.88
Matched TTPs:
  • T1584.002 - DNS Server
  • T1159 - Launch Agent
MITREへのリンク →

APT17

Score: 3.44
Matched TTPs:
  • T1656 - Impersonation
MITREへのリンク →

APT18

Score: 3.84
Matched TTPs:
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.70
Matched TTPs:
  • T1009 - Binary Padding
  • T1197 - BITS Jobs
  • T1027.014 - Polymorphic Code
  • T1213.006 - Databases
  • T1565.002 - Transmitted Data Manipulation
  • T1126 - Network Share Connection Removal
  • T1665 - Hide Infrastructure
  • T1560.001 - Archive via Utility
  • T1546.008 - Accessibility Features
  • T1597 - Search Closed Sources
  • T1609 - Container Administration Command
  • T1027.004 - Compile After Delivery
  • T1087.004 - Cloud Account
  • T1656 - Impersonation
  • T1546.013 - PowerShell Profile
  • T1131 - Authentication Package
  • T1003.007 - Proc Filesystem
  • T1183 - Image File Execution Options Injection
MITREへのリンク →

Volt Typhoon

Score: 0.55
Matched TTPs:
  • T1560.003 - Archive via Custom Method
  • T1547.005 - Security Support Provider
  • T1065 - Uncommonly Used Port
  • T1665 - Hide Infrastructure
  • T1083 - File and Directory Discovery
  • T1560.001 - Archive via Utility
  • T1159 - Launch Agent
  • T1099 - Timestomp
  • T1556.002 - Password Filter DLL
  • T1569.002 - Service Execution
  • T1584.002 - DNS Server
  • T1562.009 - Safe Mode Boot
  • T1003.007 - Proc Filesystem
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る