Trusted Design

Gone with the WindRelay: A New Malware Combo Behind a Growing Fraud Scheme

概要

A new NFC relay malware family called WindRelay has been discovered operating in combination with SpyNote RAT to enable sophisticated contactless payment fraud. The scheme uses live social engineering phone calls where fraudsters impersonate bank employees and guide victims to install personalized RAT malware labeled with the victim's own name. Once installed, the RAT enables silent deployment of WindRelay, which captures contactless payment card data via NFC when victims tap their cards to their phones. The captured data is relayed in real-time to fraudster-controlled terminals for immediate cash-out through physical purchases or ATM withdrawals. The operation employs dual monetization, combining RAT-driven digital loan fraud with NFC-based card-present transactions. Group-IB identified 23 WindRelay samples targeting victims in Czechia, Slovakia, and Slovenia between November 2025 and July 2026.

Created: 2026-08-12

Indicators

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

APT28

Score: 34.09
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1586.003 - Cloud Accounts
  • T1131 - Authentication Package
  • T1547.011 - Plist Modification
  • T1608.005 - Link Target
  • T1122 - Component Object Model Hijacking
  • T1574.009 - Path Interception by Unquoted Path
  • T1197 - BITS Jobs
  • T1585 - Establish Accounts
  • T1055.008 - Ptrace System Calls
MITREへのリンク →

APT29

Score: 41.63
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1202 - Indirect Command Execution
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1592.004 - Client Configurations
  • T1608.005 - Link Target
  • T1027.012 - LNK Icon Smuggling
  • T1556.008 - Network Provider DLL
  • T1122 - Component Object Model Hijacking
  • T1027.004 - Compile After Delivery
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Contagious Interview

Score: 32.63
Matched TTPs:
  • T1044 - File System Permissions Weakness
  • T1546.013 - PowerShell Profile
  • T1586.003 - Cloud Accounts
  • T1547.005 - Security Support Provider
  • T1131 - Authentication Package
  • T1183 - Image File Execution Options Injection
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
  • T1656 - Impersonation
MITREへのリンク →

Scattered Spider

Score: 31.89
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
  • T1547.005 - Security Support Provider
  • T1590.006 - Network Security Appliances
  • T1136.002 - Domain Account
  • T1083 - File and Directory Discovery
  • T1556.008 - Network Provider DLL
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1056 - Input Capture
  • T1197 - BITS Jobs
  • T1564.003 - Hidden Window
MITREへのリンク →

FIN4

Score: 4.13
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
MITREへのリンク →

Turla

Score: 32.93
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1099 - Timestomp
  • T1003.007 - Proc Filesystem
  • T1590.003 - Network Trust Dependencies
  • T1131 - Authentication Package
  • T1590.006 - Network Security Appliances
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1218.001 - Compiled HTML File
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
  • T1490 - Inhibit System Recovery
MITREへのリンク →

APT32

Score: 25.06
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.005 - Security Support Provider
  • T1131 - Authentication Package
  • T1590.006 - Network Security Appliances
  • T1592.004 - Client Configurations
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Saint Bear

Score: 5.78
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
MITREへのリンク →

FIN6

Score: 3.77
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1597 - Search Closed Sources
MITREへのリンク →

Sidewinder

Score: 10.35
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1590.006 - Network Security Appliances
  • T1090 - Proxy
  • T1657 - Financial Theft
MITREへのリンク →

MuddyWater

Score: 14.07
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Earth Lusca

Score: 23.99
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1003.007 - Proc Filesystem
  • T1110.003 - Password Spraying
  • T1590.006 - Network Security Appliances
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1218.001 - Compiled HTML File
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Winter Vivern

Score: 8.88
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1090 - Proxy
  • T1218.001 - Compiled HTML File
MITREへのリンク →

Silence

Score: 9.40
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1590.003 - Network Trust Dependencies
  • T1547.011 - Plist Modification
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

LazyScripter

Score: 6.44
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1136.002 - Domain Account
  • T1608.005 - Link Target
MITREへのリンク →

TA505

Score: 18.32
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1527 - Application Access Token
  • T1590.003 - Network Trust Dependencies
  • T1016.002 - Wi-Fi Discovery
  • T1136.002 - Domain Account
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

FIN7

Score: 16.33
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1573 - Encrypted Channel
  • T1056 - Input Capture
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Cobalt Group

Score: 12.19
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1598.004 - Spearphishing Voice
  • T1027.014 - Polymorphic Code
  • T1573 - Encrypted Channel
MITREへのリンク →

Higaisa

Score: 5.73
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1590.003 - Network Trust Dependencies
  • T1590.006 - Network Security Appliances
MITREへのリンク →

Kimsuky

Score: 40.37
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1213.006 - Databases
  • T1003.007 - Proc Filesystem
  • T1131 - Authentication Package
  • T1183 - Image File Execution Options Injection
  • T1590.006 - Network Security Appliances
  • T1546.008 - Accessibility Features
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027.014 - Polymorphic Code
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1656 - Impersonation
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Indrik Spider

Score: 12.93
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1003.007 - Proc Filesystem
  • T1183 - Image File Execution Options Injection
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1056 - Input Capture
MITREへのリンク →

Leafminer

Score: 6.51
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1101 - Security Support Provider
MITREへのリンク →

Mustang Panda

Score: 22.04
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1590.003 - Network Trust Dependencies
  • T1183 - Image File Execution Options Injection
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1136.003 - Cloud Account
  • T1056 - Input Capture
  • T1055.005 - Thread Local Storage
MITREへのリンク →

TA578

Score: 3.99
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
MITREへのリンク →

Star Blizzard

Score: 10.81
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1657 - Financial Theft
MITREへのリンク →

Magic Hound

Score: 30.80
Matched TTPs:
  • T1099 - Timestomp
  • T1586.003 - Cloud Accounts
  • T1016.002 - Wi-Fi Discovery
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1187 - Forced Authentication
MITREへのリンク →

HEXANE

Score: 13.18
Matched TTPs:
  • T1099 - Timestomp
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1056 - Input Capture
MITREへのリンク →

Gamaredon Group

Score: 31.17
Matched TTPs:
  • T1099 - Timestomp
  • T1527 - Application Access Token
  • T1590.003 - Network Trust Dependencies
  • T1090 - Proxy
  • T1608.005 - Link Target
  • T1554 - Compromise Host Software Binary
  • T1597 - Search Closed Sources
  • T1061 - Graphical User Interface
  • T1562.001 - Disable or Modify Tools
  • T1086 - PowerShell
MITREへのリンク →

TA2541

Score: 9.01
Matched TTPs:
  • T1099 - Timestomp
  • T1136.002 - Domain Account
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
MITREへのリンク →

Lotus Blossom

Score: 5.95
Matched TTPs:
  • T1099 - Timestomp
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

FIN13

Score: 15.60
Matched TTPs:
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1547.005 - Security Support Provider
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1134.001 - Token Impersonation/Theft
MITREへのリンク →

HAFNIUM

Score: 17.79
Matched TTPs:
  • T1099 - Timestomp
  • T1590.006 - Network Security Appliances
  • T1608.005 - Link Target
  • T1122 - Component Object Model Hijacking
  • T1056 - Input Capture
  • T1055.008 - Ptrace System Calls
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Volt Typhoon

Score: 27.13
Matched TTPs:
  • T1099 - Timestomp
  • T1003.007 - Proc Filesystem
  • T1556.002 - Password Filter DLL
  • T1547.005 - Security Support Provider
  • T1590.006 - Network Security Appliances
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1488 - Disk Content Wipe
  • T1584.002 - DNS Server
MITREへのリンク →

FIN8

Score: 5.09
Matched TTPs:
  • T1099 - Timestomp
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Mustard Tempest

Score: 4.54
Matched TTPs:
  • T1682 - Query Public AI Services
MITREへのリンク →

Daggerfly

Score: 5.52
Matched TTPs:
  • T1584.008 - Network Devices
  • T1573 - Encrypted Channel
MITREへのリンク →

GALLIUM

Score: 8.54
Matched TTPs:
  • T1584.008 - Network Devices
  • T1547.011 - Plist Modification
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Dragonfly

Score: 17.09
Matched TTPs:
  • T1584.008 - Network Devices
  • T1590.006 - Network Security Appliances
  • T1657 - Financial Theft
  • T1531 - Account Access Removal
  • T1573 - Encrypted Channel
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Ke3chang

Score: 16.14
Matched TTPs:
  • T1584.008 - Network Devices
  • T1003.007 - Proc Filesystem
  • T1590.006 - Network Security Appliances
  • T1198 - SIP and Trust Provider Hijacking
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Agrius

Score: 4.39
Matched TTPs:
  • T1584.008 - Network Devices
  • T1597 - Search Closed Sources
MITREへのリンク →

APT41

Score: 25.07
Matched TTPs:
  • T1584.008 - Network Devices
  • T1590.006 - Network Security Appliances
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1027 - Obfuscated Files or Information
  • T1573 - Encrypted Channel
  • T1574.009 - Path Interception by Unquoted Path
  • T1001.003 - Protocol or Service Impersonation
  • T1564.003 - Hidden Window
MITREへのリンク →

APT5

Score: 4.33
Matched TTPs:
  • T1584.008 - Network Devices
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

menuPass

Score: 17.42
Matched TTPs:
  • T1584.008 - Network Devices
  • T1527 - Application Access Token
  • T1590.003 - Network Trust Dependencies
  • T1547.011 - Plist Modification
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1122 - Component Object Model Hijacking
MITREへのリンク →

Threat Group-3390

Score: 16.92
Matched TTPs:
  • T1584.008 - Network Devices
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1122 - Component Object Model Hijacking
  • T1573 - Encrypted Channel
  • T1056 - Input Capture
  • T1574.009 - Path Interception by Unquoted Path
MITREへのリンク →

Wizard Spider

Score: 17.22
Matched TTPs:
  • T1584.008 - Network Devices
  • T1183 - Image File Execution Options Injection
  • T1590.006 - Network Security Appliances
  • T1083 - File and Directory Discovery
  • T1597 - Search Closed Sources
  • T1056 - Input Capture
  • T1001.003 - Protocol or Service Impersonation
MITREへのリンク →

Ember Bear

Score: 14.70
Matched TTPs:
  • T1584.008 - Network Devices
  • T1136.002 - Domain Account
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1056 - Input Capture
  • T1656 - Impersonation
MITREへのリンク →

Sandworm Team

Score: 32.17
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1590.003 - Network Trust Dependencies
  • T1016.002 - Wi-Fi Discovery
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1055.004 - Asynchronous Procedure Call
  • T1122 - Component Object Model Hijacking
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1187 - Forced Authentication
  • T1573 - Encrypted Channel
MITREへのリンク →

Leviathan

Score: 22.59
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1183 - Image File Execution Options Injection
  • T1554 - Compromise Host Software Binary
  • T1027.014 - Polymorphic Code
  • T1488 - Disk Content Wipe
  • T1056 - Input Capture
  • T1001.003 - Protocol or Service Impersonation
MITREへのリンク →

BRONZE BUTLER

Score: 10.51
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1592.004 - Client Configurations
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
MITREへのリンク →

TeamTNT

Score: 11.37
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1110.003 - Password Spraying
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
MITREへのリンク →

OilRig

Score: 10.27
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1592.002 - Software
MITREへのリンク →

Aquatic Panda

Score: 6.78
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1136.002 - Domain Account
  • T1597 - Search Closed Sources
MITREへのリンク →

Poseidon Group

Score: 4.26
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Chimera

Score: 10.03
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1590.003 - Network Trust Dependencies
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1056 - Input Capture
MITREへのリンク →

admin@338

Score: 5.73
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

APT1

Score: 10.47
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1183 - Image File Execution Options Injection
  • T1590.006 - Network Security Appliances
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Medusa Group

Score: 14.21
Matched TTPs:
  • T1590.003 - Network Trust Dependencies
  • T1183 - Image File Execution Options Injection
  • T1590.006 - Network Security Appliances
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1056 - Input Capture
MITREへのリンク →

Lazarus Group

Score: 29.53
Matched TTPs:
  • T1590.003 - Network Trust Dependencies
  • T1183 - Image File Execution Options Injection
  • T1547.011 - Plist Modification
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1069.001 - Local Groups
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1055.005 - Thread Local Storage
  • T1086 - PowerShell
MITREへのリンク →

Gorgon Group

Score: 4.08
Matched TTPs:
  • T1590.003 - Network Trust Dependencies
  • T1597 - Search Closed Sources
MITREへのリンク →

SideCopy

Score: 11.51
Matched TTPs:
  • T1590.003 - Network Trust Dependencies
  • T1590.006 - Network Security Appliances
  • T1657 - Financial Theft
  • T1584.002 - DNS Server
MITREへのリンク →

Tropic Trooper

Score: 15.58
Matched TTPs:
  • T1590.003 - Network Trust Dependencies
  • T1590.006 - Network Security Appliances
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
  • T1136.003 - Cloud Account
  • T1490 - Inhibit System Recovery
MITREへのリンク →

ToddyCat

Score: 6.03
Matched TTPs:
  • T1590.003 - Network Trust Dependencies
  • T1055.004 - Asynchronous Procedure Call
  • T1056 - Input Capture
MITREへのリンク →

APT37

Score: 4.63
Matched TTPs:
  • T1590.003 - Network Trust Dependencies
  • T1027.004 - Compile After Delivery
MITREへのリンク →

APT38

Score: 21.77
Matched TTPs:
  • T1590.003 - Network Trust Dependencies
  • T1055.004 - Asynchronous Procedure Call
  • T1590 - Gather Victim Network Information
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1493 - Transmitted Data Manipulation
  • T1059.005 - Visual Basic
MITREへのリンク →

UNC3886

Score: 14.57
Matched TTPs:
  • T1556.002 - Password Filter DLL
  • T1136.002 - Domain Account
  • T1597 - Search Closed Sources
  • T1488 - Disk Content Wipe
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Akira

Score: 10.69
Matched TTPs:
  • T1137.005 - Outlook Rules
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1056 - Input Capture
MITREへのリンク →

BlackByte

Score: 13.36
Matched TTPs:
  • T1586.003 - Cloud Accounts
  • T1590.006 - Network Security Appliances
  • T1134.001 - Token Impersonation/Theft
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

RedCurl

Score: 11.99
Matched TTPs:
  • T1016.002 - Wi-Fi Discovery
  • T1090 - Proxy
  • T1122 - Component Object Model Hijacking
  • T1027.004 - Compile After Delivery
MITREへのリンク →

LAPSUS$

Score: 15.82
Matched TTPs:
  • T1547.005 - Security Support Provider
  • T1136.002 - Domain Account
  • T1556.008 - Network Provider DLL
  • T1122 - Component Object Model Hijacking
  • T1564.003 - Hidden Window
MITREへのリンク →

SilverTerrier

Score: 3.29
Matched TTPs:
  • T1131 - Authentication Package
MITREへのリンク →

Moonstone Sleet

Score: 12.47
Matched TTPs:
  • T1183 - Image File Execution Options Injection
  • T1590.006 - Network Security Appliances
  • T1027 - Obfuscated Files or Information
  • T1573 - Encrypted Channel
  • T1197 - BITS Jobs
MITREへのリンク →

APT42

Score: 7.60
Matched TTPs:
  • T1183 - Image File Execution Options Injection
  • T1590.006 - Network Security Appliances
  • T1599 - Network Boundary Bridging
MITREへのリンク →

CURIUM

Score: 5.91
Matched TTPs:
  • T1183 - Image File Execution Options Injection
  • T1218.001 - Compiled HTML File
MITREへのリンク →

Silent Librarian

Score: 6.13
Matched TTPs:
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
MITREへのリンク →

APT39

Score: 12.37
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1599 - Network Boundary Bridging
  • T1001.003 - Protocol or Service Impersonation
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Tonto Team

Score: 5.09
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1027.004 - Compile After Delivery
MITREへのリンク →

APT3

Score: 9.24
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1590.006 - Network Security Appliances
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Salt Typhoon

Score: 3.84
Matched TTPs:
  • T1110.003 - Password Spraying
MITREへのリンク →

Play

Score: 9.37
Matched TTPs:
  • T1590.006 - Network Security Appliances
  • T1597 - Search Closed Sources
  • T1574.009 - Path Interception by Unquoted Path
  • T1490 - Inhibit System Recovery
MITREへのリンク →

APT19

Score: 4.22
Matched TTPs:
  • T1590.006 - Network Security Appliances
  • T1027.014 - Polymorphic Code
MITREへのリンク →

ZIRCONIUM

Score: 11.27
Matched TTPs:
  • T1590.006 - Network Security Appliances
  • T1608.005 - Link Target
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
MITREへのリンク →

Deep Panda

Score: 6.03
Matched TTPs:
  • T1177 - LSASS Driver
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Axiom

Score: 3.29
Matched TTPs:
  • T1177 - LSASS Driver
MITREへのリンク →

Fox Kitten

Score: 6.72
Matched TTPs:
  • T1177 - LSASS Driver
  • T1656 - Impersonation
MITREへのリンク →

LuminousMoth

Score: 7.91
Matched TTPs:
  • T1136.002 - Domain Account
  • T1056 - Input Capture
  • T1574.009 - Path Interception by Unquoted Path
MITREへのリンク →

Andariel

Score: 8.04
Matched TTPs:
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
  • T1187 - Forced Authentication
MITREへのリンク →

BackdoorDiplomacy

Score: 4.19
Matched TTPs:
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Equation

Score: 4.54
Matched TTPs:
  • T1589.003 - Employee Names
MITREへのリンク →

INC Ransom

Score: 9.49
Matched TTPs:
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Velvet Ant

Score: 8.60
Matched TTPs:
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1490 - Inhibit System Recovery
MITREへのリンク →

APT17

Score: 5.45
Matched TTPs:
  • T1608.005 - Link Target
  • T1656 - Impersonation
MITREへのリンク →

Confucius

Score: 4.02
Matched TTPs:
  • T1608.005 - Link Target
  • T1056 - Input Capture
MITREへのリンク →

POLONIUM

Score: 6.77
Matched TTPs:
  • T1608.005 - Link Target
  • T1122 - Component Object Model Hijacking
  • T1056 - Input Capture
MITREへのリンク →

Storm-0501

Score: 15.77
Matched TTPs:
  • T1027.012 - LNK Icon Smuggling
  • T1027 - Obfuscated Files or Information
  • T1027.014 - Polymorphic Code
  • T1056 - Input Capture
  • T1158 - Hidden Files and Directories
MITREへのリンク →

GOLD SOUTHFIELD

Score: 5.67
Matched TTPs:
  • T1122 - Component Object Model Hijacking
  • T1573 - Encrypted Channel
MITREへのリンク →

Sea Turtle

Score: 5.41
Matched TTPs:
  • T1122 - Component Object Model Hijacking
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Rocke

Score: 6.54
Matched TTPs:
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027.004 - Compile After Delivery
MITREへのリンク →

WIRTE

Score: 5.14
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
MITREへのリンク →

DarkHydrus

Score: 4.13
Matched TTPs:
  • T1531 - Account Access Removal
MITREへのリンク →

Storm-1811

Score: 10.72
Matched TTPs:
  • T1027 - Obfuscated Files or Information
  • T1599 - Network Boundary Bridging
  • T1486 - Data Encrypted for Impact
MITREへのリンク →

Cinnamon Tempest

Score: 4.35
Matched TTPs:
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Patchwork

Score: 3.44
Matched TTPs:
  • T1001.003 - Protocol or Service Impersonation
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

APT29

Score: 0.70
Matched TTPs:
  • T1122 - Component Object Model Hijacking
  • T1584.008 - Network Devices
  • T1608.005 - Link Target
  • T1556.008 - Network Provider DLL
  • T1027.004 - Compile After Delivery
  • T1592.004 - Client Configurations
  • T1547.011 - Plist Modification
  • T1099 - Timestomp
  • T1222.002 - Linux and Mac Permissions
  • T1202 - Indirect Command Execution
  • T1490 - Inhibit System Recovery
  • T1027.012 - LNK Icon Smuggling
  • T1177 - LSASS Driver
MITREへのリンク →

Kimsuky

Score: 0.68
Matched TTPs:
  • T1546.008 - Accessibility Features
  • T1597 - Search Closed Sources
  • T1656 - Impersonation
  • T1608.005 - Link Target
  • T1027.004 - Compile After Delivery
  • T1183 - Image File Execution Options Injection
  • T1590.006 - Network Security Appliances
  • T1490 - Inhibit System Recovery
  • T1027.014 - Polymorphic Code
  • T1056 - Input Capture
  • T1213.006 - Databases
  • T1003.007 - Proc Filesystem
  • T1197 - BITS Jobs
  • T1131 - Authentication Package
  • T1546.013 - PowerShell Profile
MITREへのリンク →

APT28

Score: 0.57
Matched TTPs:
  • T1122 - Component Object Model Hijacking
  • T1608.005 - Link Target
  • T1585 - Establish Accounts
  • T1547.011 - Plist Modification
  • T1055.008 - Ptrace System Calls
  • T1222.002 - Linux and Mac Permissions
  • T1574.009 - Path Interception by Unquoted Path
  • T1586.003 - Cloud Accounts
  • T1131 - Authentication Package
  • T1197 - BITS Jobs
MITREへのリンク →

Turla

Score: 0.55
Matched TTPs:
  • T1597 - Search Closed Sources
  • T1608.005 - Link Target
  • T1027.004 - Compile After Delivery
  • T1590.006 - Network Security Appliances
  • T1099 - Timestomp
  • T1590.003 - Network Trust Dependencies
  • T1136.002 - Domain Account
  • T1056 - Input Capture
  • T1055.004 - Asynchronous Procedure Call
  • T1490 - Inhibit System Recovery
  • T1003.007 - Proc Filesystem
  • T1218.001 - Compiled HTML File
  • T1131 - Authentication Package
  • T1546.013 - PowerShell Profile
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る