Trusted Design

Analysis of Kimsuky's Attack on a South Korean Groupware Vendor Using a New Gomir Family Variant

概要

Between 2025 and early 2026, the North Korean-linked Kimsuky group infiltrated South Korean groupware vendors through vulnerability exploitation and spear-phishing. They deployed two new malware variants, BirdTroy and DriveTroy, based on the Gomir/HttpTroy family. BirdTroy uses custom protocols and HTTP/3 (QUIC) for command-and-control communication, while DriveTroy abuses Google Drive as a C2 channel to evade detection. Following initial compromise, Kimsuky conducted aggressive lateral movement, compromising customer groupware servers and tampering with vendor login pages to harvest credentials. The attackers leveraged legitimate tools like DWAgent for remote access and custom proxy tools for lateral movement. Attribution is supported by malware characteristics, infrastructure patterns including default XAMPP certificates, and historical ASN usage consistent with previous Kimsuky operations.

Created: 2026-07-21

Indicators

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

APT28

Score: 18.78
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1547.011 - Plist Modification
  • T1608.005 - Link Target
  • T1122 - Component Object Model Hijacking
  • T1197 - BITS Jobs
MITREへのリンク →

APT29

Score: 42.65
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1202 - Indirect Command Execution
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1592.004 - Client Configurations
  • T1036.002 - Right-to-Left Override
  • T1568 - Dynamic Resolution
  • T1608.005 - Link Target
  • T1556.008 - Network Provider DLL
  • T1122 - Component Object Model Hijacking
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Contagious Interview

Score: 22.83
Matched TTPs:
  • T1044 - File System Permissions Weakness
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1656 - Impersonation
MITREへのリンク →

Turla

Score: 18.68
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1099 - Timestomp
  • T1063 - Security Software Discovery
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
MITREへのリンク →

APT32

Score: 14.01
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1592.004 - Client Configurations
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
MITREへのリンク →

Saint Bear

Score: 5.78
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
MITREへのリンク →

FIN6

Score: 9.58
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1063 - Security Software Discovery
  • T1487 - Disk Structure Wipe
  • T1597 - Search Closed Sources
MITREへのリンク →

Sidewinder

Score: 6.91
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1487 - Disk Structure Wipe
  • T1159 - Launch Agent
MITREへのリンク →

MuddyWater

Score: 19.48
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1518.002 - Backup Software Discovery
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1159 - Launch Agent
MITREへのリンク →

Earth Lusca

Score: 12.04
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Winter Vivern

Score: 8.96
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1587.003 - Digital Certificates
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
MITREへのリンク →

Silence

Score: 4.72
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
MITREへのリンク →

LazyScripter

Score: 10.71
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1098.007 - Additional Local or Domain Groups
  • T1136.002 - Domain Account
  • T1608.005 - Link Target
MITREへのリンク →

TA505

Score: 15.21
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1527 - Application Access Token
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1136.002 - Domain Account
  • T1597 - Search Closed Sources
MITREへのリンク →

FIN7

Score: 14.21
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1608.005 - Link Target
  • T1065 - Uncommonly Used Port
MITREへのリンク →

Cobalt Group

Score: 13.39
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1518.002 - Backup Software Discovery
  • T1598.004 - Spearphishing Voice
MITREへのリンク →

Higaisa

Score: 4.81
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1665 - Hide Infrastructure
MITREへのリンク →

Kimsuky

Score: 39.65
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1213.006 - Databases
  • T1098.007 - Additional Local or Domain Groups
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1656 - Impersonation
  • T1665 - Hide Infrastructure
MITREへのリンク →

Indrik Spider

Score: 6.06
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1183 - Image File Execution Options Injection
  • T1597 - Search Closed Sources
MITREへのリンク →

Leafminer

Score: 6.51
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1101 - Security Support Provider
MITREへのリンク →

Mustang Panda

Score: 29.72
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1596.001 - DNS/Passive DNS
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1546.011 - Application Shimming
  • T1183 - Image File Execution Options Injection
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1136.003 - Cloud Account
  • T1159 - Launch Agent
  • T1055.005 - Thread Local Storage
MITREへのリンク →

TA578

Score: 3.99
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
MITREへのリンク →

Star Blizzard

Score: 12.15
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1609 - Container Administration Command
MITREへのリンク →

Magic Hound

Score: 24.27
Matched TTPs:
  • T1099 - Timestomp
  • T1587.003 - Digital Certificates
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1547.005 - Security Support Provider
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
MITREへのリンク →

HEXANE

Score: 17.58
Matched TTPs:
  • T1099 - Timestomp
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1055.004 - Asynchronous Procedure Call
  • T1065 - Uncommonly Used Port
  • T1159 - Launch Agent
MITREへのリンク →

Gamaredon Group

Score: 26.06
Matched TTPs:
  • T1099 - Timestomp
  • T1527 - Application Access Token
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1036.002 - Right-to-Left Override
  • T1608.005 - Link Target
  • T1554 - Compromise Host Software Binary
  • T1597 - Search Closed Sources
  • T1061 - Graphical User Interface
MITREへのリンク →

TA2541

Score: 13.82
Matched TTPs:
  • T1099 - Timestomp
  • T1098.007 - Additional Local or Domain Groups
  • T1136.002 - Domain Account
  • T1036.002 - Right-to-Left Override
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
MITREへのリンク →

Lotus Blossom

Score: 4.48
Matched TTPs:
  • T1099 - Timestomp
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

FIN13

Score: 14.13
Matched TTPs:
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1547.005 - Security Support Provider
  • T1055.004 - Asynchronous Procedure Call
  • T1134.001 - Token Impersonation/Theft
MITREへのリンク →

HAFNIUM

Score: 13.54
Matched TTPs:
  • T1099 - Timestomp
  • T1487 - Disk Structure Wipe
  • T1608.005 - Link Target
  • T1122 - Component Object Model Hijacking
  • T1210 - Exploitation of Remote Services
MITREへのリンク →

Volt Typhoon

Score: 28.50
Matched TTPs:
  • T1099 - Timestomp
  • T1556.002 - Password Filter DLL
  • T1547.005 - Security Support Provider
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1584.002 - DNS Server
  • T1065 - Uncommonly Used Port
  • T1159 - Launch Agent
  • T1665 - Hide Infrastructure
MITREへのリンク →

Mustard Tempest

Score: 4.54
Matched TTPs:
  • T1682 - Query Public AI Services
MITREへのリンク →

GALLIUM

Score: 7.07
Matched TTPs:
  • T1584.008 - Network Devices
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Dragonfly

Score: 12.92
Matched TTPs:
  • T1584.008 - Network Devices
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1531 - Account Access Removal
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Ke3chang

Score: 13.80
Matched TTPs:
  • T1584.008 - Network Devices
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1487 - Disk Structure Wipe
  • T1198 - SIP and Trust Provider Hijacking
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Agrius

Score: 6.58
Matched TTPs:
  • T1584.008 - Network Devices
  • T1487 - Disk Structure Wipe
  • T1597 - Search Closed Sources
MITREへのリンク →

APT41

Score: 18.74
Matched TTPs:
  • T1584.008 - Network Devices
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1208 - Kerberoasting
  • T1564.003 - Hidden Window
MITREへのリンク →

APT5

Score: 4.33
Matched TTPs:
  • T1584.008 - Network Devices
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

menuPass

Score: 17.37
Matched TTPs:
  • T1584.008 - Network Devices
  • T1527 - Application Access Token
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1122 - Component Object Model Hijacking
MITREへのリンク →

Threat Group-3390

Score: 18.75
Matched TTPs:
  • T1584.008 - Network Devices
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1218.003 - CMSTP
  • T1055.004 - Asynchronous Procedure Call
  • T1122 - Component Object Model Hijacking
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

Wizard Spider

Score: 10.30
Matched TTPs:
  • T1584.008 - Network Devices
  • T1183 - Image File Execution Options Injection
  • T1083 - File and Directory Discovery
  • T1597 - Search Closed Sources
MITREへのリンク →

Ember Bear

Score: 15.22
Matched TTPs:
  • T1584.008 - Network Devices
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1487 - Disk Structure Wipe
  • T1136.002 - Domain Account
  • T1597 - Search Closed Sources
  • T1656 - Impersonation
MITREへのリンク →

Silent Librarian

Score: 14.24
Matched TTPs:
  • T1596.001 - DNS/Passive DNS
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
MITREへのリンク →

Lazarus Group

Score: 32.94
Matched TTPs:
  • T1596.001 - DNS/Passive DNS
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1210 - Exploitation of Remote Services
  • T1069.001 - Local Groups
  • T1597 - Search Closed Sources
  • T1055.005 - Thread Local Storage
  • T1665 - Hide Infrastructure
MITREへのリンク →

Sea Turtle

Score: 14.32
Matched TTPs:
  • T1596.001 - DNS/Passive DNS
  • T1587.003 - Digital Certificates
  • T1063 - Security Software Discovery
  • T1098.007 - Additional Local or Domain Groups
  • T1122 - Component Object Model Hijacking
MITREへのリンク →

UNC3886

Score: 24.60
Matched TTPs:
  • T1596.001 - DNS/Passive DNS
  • T1689 - Downgrade Attack
  • T1556.002 - Password Filter DLL
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1136.002 - Domain Account
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
MITREへのリンク →

LuminousMoth

Score: 5.61
Matched TTPs:
  • T1596.001 - DNS/Passive DNS
  • T1136.002 - Domain Account
MITREへのリンク →

BlackTech

Score: 3.15
Matched TTPs:
  • T1596.001 - DNS/Passive DNS
MITREへのリンク →

Chimera

Score: 12.79
Matched TTPs:
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1587.003 - Digital Certificates
  • T1487 - Disk Structure Wipe
  • T1055.004 - Asynchronous Procedure Call
  • T1665 - Hide Infrastructure
MITREへのリンク →

OilRig

Score: 15.06
Matched TTPs:
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1592.002 - Software
MITREへのリンク →

APT39

Score: 7.83
Matched TTPs:
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1547.011 - Plist Modification
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Tropic Trooper

Score: 16.38
Matched TTPs:
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1487 - Disk Structure Wipe
  • T1055.004 - Asynchronous Procedure Call
  • T1136.003 - Cloud Account
  • T1159 - Launch Agent
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT18

Score: 6.59
Matched TTPs:
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

RedCurl

Score: 14.18
Matched TTPs:
  • T1587.003 - Digital Certificates
  • T1487 - Disk Structure Wipe
  • T1016.002 - Wi-Fi Discovery
  • T1122 - Component Object Model Hijacking
  • T1027.004 - Compile After Delivery
MITREへのリンク →

APT1

Score: 13.47
Matched TTPs:
  • T1587.003 - Digital Certificates
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Scattered Spider

Score: 34.87
Matched TTPs:
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1136.002 - Domain Account
  • T1609 - Container Administration Command
  • T1083 - File and Directory Discovery
  • T1556.008 - Network Provider DLL
  • T1210 - Exploitation of Remote Services
  • T1597 - Search Closed Sources
  • T1197 - BITS Jobs
  • T1564.003 - Hidden Window
MITREへのリンク →

Storm-0501

Score: 4.13
Matched TTPs:
  • T1685.004 - Disable or Modify Linux Audit System Log
MITREへのリンク →

Sandworm Team

Score: 23.51
Matched TTPs:
  • T1063 - Security Software Discovery
  • T1484.002 - Trust Modification
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1055.004 - Asynchronous Procedure Call
  • T1122 - Component Object Model Hijacking
MITREへのリンク →

Leviathan

Score: 12.07
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1554 - Compromise Host Software Binary
MITREへのリンク →

FIN5

Score: 4.93
Matched TTPs:
  • T1487 - Disk Structure Wipe
  • T1547.011 - Plist Modification
MITREへのリンク →

Confucius

Score: 7.03
Matched TTPs:
  • T1487 - Disk Structure Wipe
  • T1608.005 - Link Target
  • T1665 - Hide Infrastructure
MITREへのリンク →

Patchwork

Score: 5.02
Matched TTPs:
  • T1487 - Disk Structure Wipe
  • T1665 - Hide Infrastructure
MITREへのリンク →

Akira

Score: 6.34
Matched TTPs:
  • T1137.005 - Outlook Rules
  • T1597 - Search Closed Sources
MITREへのリンク →

Storm-1811

Score: 6.06
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1486 - Data Encrypted for Impact
MITREへのリンク →

APT42

Score: 3.80
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
MITREへのリンク →

IndigoZebra

Score: 3.53
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
MITREへのリンク →

Transparent Tribe

Score: 4.80
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1036.002 - Right-to-Left Override
MITREへのリンク →

ZIRCONIUM

Score: 9.31
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
MITREへのリンク →

RedEcho

Score: 4.80
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1036.002 - Right-to-Left Override
MITREへのリンク →

EXOTIC LILY

Score: 3.80
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
MITREへのリンク →

APT38

Score: 16.47
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1590 - Gather Victim Network Information
  • T1597 - Search Closed Sources
  • T1493 - Transmitted Data Manipulation
MITREへのリンク →

Moonstone Sleet

Score: 7.24
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1197 - BITS Jobs
MITREへのリンク →

BITTER

Score: 4.80
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1036.002 - Right-to-Left Override
MITREへのリンク →

TeamTNT

Score: 10.22
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1665 - Hide Infrastructure
MITREへのリンク →

CURIUM

Score: 3.80
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
MITREへのリンク →

Medusa Group

Score: 12.57
Matched TTPs:
  • T1218.003 - CMSTP
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
MITREへのリンク →

LAPSUS$

Score: 22.88
Matched TTPs:
  • T1547.005 - Security Support Provider
  • T1136.002 - Domain Account
  • T1609 - Container Administration Command
  • T1556.008 - Network Provider DLL
  • T1122 - Component Object Model Hijacking
  • T1065 - Uncommonly Used Port
  • T1564.003 - Hidden Window
MITREへのリンク →

Rocke

Score: 6.48
Matched TTPs:
  • T1009 - Binary Padding
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
MITREへのリンク →

ToddyCat

Score: 6.91
Matched TTPs:
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1665 - Hide Infrastructure
MITREへのリンク →

Velvet Ant

Score: 5.87
Matched TTPs:
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
MITREへのリンク →

BlackByte

Score: 8.27
Matched TTPs:
  • T1009 - Binary Padding
  • T1134.001 - Token Impersonation/Theft
  • T1597 - Search Closed Sources
MITREへのリンク →

Tonto Team

Score: 5.09
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1027.004 - Compile After Delivery
MITREへのリンク →

APT3

Score: 7.77
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Deep Panda

Score: 3.29
Matched TTPs:
  • T1177 - LSASS Driver
MITREへのリンク →

Axiom

Score: 3.29
Matched TTPs:
  • T1177 - LSASS Driver
MITREへのリンク →

Fox Kitten

Score: 6.72
Matched TTPs:
  • T1177 - LSASS Driver
  • T1656 - Impersonation
MITREへのリンク →

Aquatic Panda

Score: 4.26
Matched TTPs:
  • T1136.002 - Domain Account
  • T1597 - Search Closed Sources
MITREへのリンク →

Andariel

Score: 4.19
Matched TTPs:
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

BackdoorDiplomacy

Score: 4.19
Matched TTPs:
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

BRONZE BUTLER

Score: 14.57
Matched TTPs:
  • T1592.004 - Client Configurations
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1159 - Launch Agent
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

INC Ransom

Score: 7.15
Matched TTPs:
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
MITREへのリンク →

APT17

Score: 5.45
Matched TTPs:
  • T1608.005 - Link Target
  • T1656 - Impersonation
MITREへのリンク →

POLONIUM

Score: 4.76
Matched TTPs:
  • T1608.005 - Link Target
  • T1122 - Component Object Model Hijacking
MITREへのリンク →

APT37

Score: 6.47
Matched TTPs:
  • T1078 - Valid Accounts
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Windshift

Score: 6.88
Matched TTPs:
  • T1078 - Valid Accounts
  • T1159 - Launch Agent
MITREへのリンク →

DarkHydrus

Score: 4.13
Matched TTPs:
  • T1531 - Account Access Removal
MITREへのリンク →

SideCopy

Score: 6.88
Matched TTPs:
  • T1584.002 - DNS Server
  • T1159 - Launch Agent
MITREへのリンク →

DarkVishnya

Score: 4.54
Matched TTPs:
  • T1213.003 - Code Repositories
MITREへのリンク →

Blue Mockingbird

Score: 4.54
Matched TTPs:
  • T1001.001 - Junk Data
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

APT29

Score: 0.70
Matched TTPs:
  • T1584.008 - Network Devices
  • T1556.008 - Network Provider DLL
  • T1547.011 - Plist Modification
  • T1222.002 - Linux and Mac Permissions
  • T1568 - Dynamic Resolution
  • T1608.005 - Link Target
  • T1202 - Indirect Command Execution
  • T1027.004 - Compile After Delivery
  • T1177 - LSASS Driver
  • T1122 - Component Object Model Hijacking
  • T1592.004 - Client Configurations
  • T1099 - Timestomp
  • T1036.002 - Right-to-Left Override
MITREへのリンク →

Kimsuky

Score: 0.65
Matched TTPs:
  • T1665 - Hide Infrastructure
  • T1197 - BITS Jobs
  • T1609 - Container Administration Command
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1546.011 - Application Shimming
  • T1546.008 - Accessibility Features
  • T1213.006 - Databases
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1656 - Impersonation
  • T1027.004 - Compile After Delivery
  • T1098.007 - Additional Local or Domain Groups
  • T1546.013 - PowerShell Profile
MITREへのリンク →

Scattered Spider

Score: 0.57
Matched TTPs:
  • T1197 - BITS Jobs
  • T1609 - Container Administration Command
  • T1556.008 - Network Provider DLL
  • T1210 - Exploitation of Remote Services
  • T1083 - File and Directory Discovery
  • T1597 - Search Closed Sources
  • T1564.003 - Hidden Window
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1136.002 - Domain Account
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る