Trusted Design

‘The Gentlemen’ Profile: Why This Ransomware Group Wants In Before It Locks You Out

概要

The Gentlemen is a financially motivated ransomware group operating since July 2025 using a Ransomware-as-a-Service model with dual-extortion tactics. They exfiltrate sensitive data before encrypting systems, targeting Windows, Linux, and ESXi environments. The group focuses heavily on preparation before encryption, using legitimate administrative tools like PowerRun.exe for privilege escalation, and establishing persistence through multiple mechanisms including registry modifications, scheduled tasks, and autostart configurations. They disable security tools, delete logs, terminate database and backup services, and use XChaCha20 and Curve25519 encryption. Primarily targeting medium-to-large organizations in the Asia-Pacific region, their activity has increased by 2,100% compared to typical levels. Victims receive ransom notes with approximately 10-day deadlines threatening to publish stolen data on leak sites if demands are not met.

Created: 2026-08-27

Indicators

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

HAFNIUM

Score: 15.53
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1487 - Disk Structure Wipe
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1122 - Component Object Model Hijacking
  • T1547.013 - XDG Autostart Entries
  • T1490 - Inhibit System Recovery
MITREへのリンク →

menuPass

Score: 20.54
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1527 - Application Access Token
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1122 - Component Object Model Hijacking
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Wizard Spider

Score: 13.47
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1183 - Image File Execution Options Injection
  • T1083 - File and Directory Discovery
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

APT33

Score: 14.24
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1071.005 - Publish/Subscribe Protocols
  • T1117 - Regsvr32
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Fox Kitten

Score: 8.98
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1177 - LSASS Driver
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Volt Typhoon

Score: 40.63
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1560.003 - Archive via Custom Method
  • T1071.005 - Publish/Subscribe Protocols
  • T1562.009 - Safe Mode Boot
  • T1686.003 - Windows Host Firewall
  • T1003.007 - Proc Filesystem
  • T1547.005 - Security Support Provider
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1488 - Disk Content Wipe
  • T1584.002 - DNS Server
  • T1547.013 - XDG Autostart Entries
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT1

Score: 14.30
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1487 - Disk Structure Wipe
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Mustang Panda

Score: 33.65
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1053.007 - Container Orchestration Job
  • T1071.005 - Publish/Subscribe Protocols
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1546.011 - Application Shimming
  • T1183 - Image File Execution Options Injection
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1136.003 - Cloud Account
  • T1547.013 - XDG Autostart Entries
  • T1055.005 - Thread Local Storage
MITREへのリンク →

Play

Score: 11.07
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1574.009 - Path Interception by Unquoted Path
  • T1547.013 - XDG Autostart Entries
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Chimera

Score: 12.45
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1487 - Disk Structure Wipe
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
  • T1665 - Hide Infrastructure
MITREへのリンク →

Sea Turtle

Score: 8.52
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1098.007 - Additional Local or Domain Groups
  • T1122 - Component Object Model Hijacking
  • T1490 - Inhibit System Recovery
MITREへのリンク →

APT39

Score: 12.10
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1566.001 - Spearphishing Attachment
  • T1547.011 - Plist Modification
  • T1497.002 - User Activity Based Checks
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

RedCurl

Score: 18.34
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1071.005 - Publish/Subscribe Protocols
  • T1487 - Disk Structure Wipe
  • T1016.002 - Wi-Fi Discovery
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1122 - Component Object Model Hijacking
  • T1027.004 - Compile After Delivery
MITREへのリンク →

APT5

Score: 6.72
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

Agrius

Score: 8.17
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1487 - Disk Structure Wipe
  • T1597 - Search Closed Sources
MITREへのリンク →

GALLIUM

Score: 10.24
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

APT41

Score: 29.32
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1560.003 - Archive via Custom Method
  • T1584.008 - Network Devices
  • T1562.004 - Disable or Modify System Firewall
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1027 - Obfuscated Files or Information
  • T1574.009 - Path Interception by Unquoted Path
  • T1030 - Data Transfer Size Limits
  • T1564.003 - Hidden Window
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

MuddyWater

Score: 24.44
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1071.005 - Publish/Subscribe Protocols
  • T1547.011 - Plist Modification
  • T1117 - Regsvr32
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

APT28

Score: 31.60
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1222.002 - Linux and Mac Permissions
  • T1071.005 - Publish/Subscribe Protocols
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1562.004 - Disable or Modify System Firewall
  • T1547.011 - Plist Modification
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1122 - Component Object Model Hijacking
  • T1574.009 - Path Interception by Unquoted Path
  • T1547.013 - XDG Autostart Entries
  • T1546.007 - Netsh Helper DLL
MITREへのリンク →

Turla

Score: 23.42
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1099 - Timestomp
  • T1003.007 - Proc Filesystem
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
  • T1490 - Inhibit System Recovery
MITREへのリンク →

BRONZE BUTLER

Score: 20.04
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1071.005 - Publish/Subscribe Protocols
  • T1003.007 - Proc Filesystem
  • T1592.004 - Client Configurations
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

UNC3886

Score: 23.56
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1689 - Downgrade Attack
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1136.002 - Domain Account
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1488 - Disk Content Wipe
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Kimsuky

Score: 61.54
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1053.007 - Container Orchestration Job
  • T1213.006 - Databases
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
  • T1051 - Shared Webroot
  • T1608.005 - Link Target
  • T1654 - Log Enumeration
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027.014 - Polymorphic Code
  • T1690 - Prevent Command History Logging
  • T1030 - Data Transfer Size Limits
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
  • T1665 - Hide Infrastructure
  • T1490 - Inhibit System Recovery
MITREへのリンク →

APT3

Score: 16.74
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1560.003 - Archive via Custom Method
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

FIN8

Score: 8.26
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1497.002 - User Activity Based Checks
  • T1027 - Obfuscated Files or Information
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Ke3chang

Score: 15.94
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1487 - Disk Structure Wipe
  • T1003.007 - Proc Filesystem
  • T1198 - SIP and Trust Provider Hijacking
  • T1055.004 - Asynchronous Procedure Call
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Lotus Blossom

Score: 6.07
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

FIN13

Score: 23.11
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1560.003 - Archive via Custom Method
  • T1584.008 - Network Devices
  • T1547.005 - Security Support Provider
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1134.001 - Token Impersonation/Theft
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Earth Lusca

Score: 23.39
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1562.004 - Disable or Modify System Firewall
  • T1110.003 - Password Spraying
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Magic Hound

Score: 31.49
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1547.005 - Security Support Provider
  • T1009 - Binary Padding
  • T1562.004 - Disable or Modify System Firewall
  • T1183 - Image File Execution Options Injection
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Aquatic Panda

Score: 12.54
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1003.007 - Proc Filesystem
  • T1562.004 - Disable or Modify System Firewall
  • T1136.002 - Domain Account
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

INC Ransom

Score: 11.86
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Akira

Score: 11.07
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1137.005 - Outlook Rules
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

ToddyCat

Score: 9.30
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT29

Score: 41.66
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1202 - Indirect Command Execution
  • T1562.004 - Disable or Modify System Firewall
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1592.004 - Client Configurations
  • T1608.005 - Link Target
  • T1556.008 - Network Provider DLL
  • T1497.002 - User Activity Based Checks
  • T1122 - Component Object Model Hijacking
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Scattered Spider

Score: 44.48
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
  • T1560.003 - Archive via Custom Method
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1136.002 - Domain Account
  • T1609 - Container Administration Command
  • T1083 - File and Directory Discovery
  • T1051 - Shared Webroot
  • T1556.008 - Network Provider DLL
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1030 - Data Transfer Size Limits
  • T1564.003 - Hidden Window
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

FIN4

Score: 4.13
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
MITREへのリンク →

APT32

Score: 23.40
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1592.004 - Client Configurations
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
  • T1547.013 - XDG Autostart Entries
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Saint Bear

Score: 9.62
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1030 - Data Transfer Size Limits
MITREへのリンク →

FIN6

Score: 6.76
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1487 - Disk Structure Wipe
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
MITREへのリンク →

Sidewinder

Score: 5.74
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1487 - Disk Structure Wipe
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Winter Vivern

Score: 9.85
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1562.004 - Disable or Modify System Firewall
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Silence

Score: 8.69
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Contagious Interview

Score: 26.66
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1071.005 - Publish/Subscribe Protocols
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1690 - Prevent Command History Logging
  • T1030 - Data Transfer Size Limits
  • T1027.004 - Compile After Delivery
MITREへのリンク →

LazyScripter

Score: 9.54
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1136.002 - Domain Account
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

TA505

Score: 24.94
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1560.003 - Archive via Custom Method
  • T1527 - Application Access Token
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1136.002 - Domain Account
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

FIN7

Score: 16.83
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1547.013 - XDG Autostart Entries
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Cobalt Group

Score: 10.83
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1598.004 - Spearphishing Voice
  • T1497.002 - User Activity Based Checks
  • T1027.014 - Polymorphic Code
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Higaisa

Score: 7.33
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1071.005 - Publish/Subscribe Protocols
  • T1665 - Hide Infrastructure
MITREへのリンク →

Indrik Spider

Score: 15.02
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1003.007 - Proc Filesystem
  • T1183 - Image File Execution Options Injection
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Molerats

Score: 3.55
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Leafminer

Score: 12.66
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1117 - Regsvr32
  • T1101 - Security Support Provider
  • T1051 - Shared Webroot
MITREへのリンク →

TA578

Score: 3.99
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
MITREへのリンク →

Evilnum

Score: 6.19
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1562.009 - Safe Mode Boot
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Star Blizzard

Score: 12.15
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1609 - Container Administration Command
MITREへのリンク →

HEXANE

Score: 12.79
Matched TTPs:
  • T1099 - Timestomp
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Gamaredon Group

Score: 25.65
Matched TTPs:
  • T1099 - Timestomp
  • T1527 - Application Access Token
  • T1562.009 - Safe Mode Boot
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1554 - Compromise Host Software Binary
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

TA2541

Score: 12.11
Matched TTPs:
  • T1099 - Timestomp
  • T1098.007 - Additional Local or Domain Groups
  • T1136.002 - Domain Account
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Mustard Tempest

Score: 5.31
Matched TTPs:
  • T1682 - Query Public AI Services
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Daggerfly

Score: 4.17
Matched TTPs:
  • T1584.008 - Network Devices
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Dragonfly

Score: 17.09
Matched TTPs:
  • T1584.008 - Network Devices
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1562.004 - Disable or Modify System Firewall
  • T1654 - Log Enumeration
  • T1497.002 - User Activity Based Checks
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Threat Group-3390

Score: 28.31
Matched TTPs:
  • T1584.008 - Network Devices
  • T1487 - Disk Structure Wipe
  • T1098.007 - Additional Local or Domain Groups
  • T1218.003 - CMSTP
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1122 - Component Object Model Hijacking
  • T1678 - Delay Execution
  • T1574.009 - Path Interception by Unquoted Path
  • T1547.013 - XDG Autostart Entries
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

Ember Bear

Score: 17.35
Matched TTPs:
  • T1584.008 - Network Devices
  • T1487 - Disk Structure Wipe
  • T1562.004 - Disable or Modify System Firewall
  • T1136.002 - Domain Account
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Storm-0501

Score: 13.86
Matched TTPs:
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1686.003 - Windows Host Firewall
  • T1497.002 - User Activity Based Checks
  • T1027 - Obfuscated Files or Information
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Darkhotel

Score: 6.74
Matched TTPs:
  • T1071.005 - Publish/Subscribe Protocols
  • T1562.009 - Safe Mode Boot
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Lazarus Group

Score: 32.44
Matched TTPs:
  • T1071.005 - Publish/Subscribe Protocols
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1069.001 - Local Groups
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1547.013 - XDG Autostart Entries
  • T1055.005 - Thread Local Storage
  • T1665 - Hide Infrastructure
MITREへのリンク →

ZIRCONIUM

Score: 9.17
Matched TTPs:
  • T1071.005 - Publish/Subscribe Protocols
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Stealth Falcon

Score: 3.32
Matched TTPs:
  • T1071.005 - Publish/Subscribe Protocols
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

Inception

Score: 6.07
Matched TTPs:
  • T1071.005 - Publish/Subscribe Protocols
  • T1497.002 - User Activity Based Checks
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Sandworm Team

Score: 37.17
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1686.003 - Windows Host Firewall
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1562.004 - Disable or Modify System Firewall
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1122 - Component Object Model Hijacking
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1075 - Pass the Hash
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Leviathan

Score: 22.83
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1098.007 - Additional Local or Domain Groups
  • T1562.004 - Disable or Modify System Firewall
  • T1183 - Image File Execution Options Injection
  • T1497.002 - User Activity Based Checks
  • T1554 - Compromise Host Software Binary
  • T1027.014 - Polymorphic Code
  • T1488 - Disk Content Wipe
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

OilRig

Score: 25.31
Matched TTPs:
  • T1562.009 - Safe Mode Boot
  • T1487 - Disk Structure Wipe
  • T1566.001 - Spearphishing Attachment
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1117 - Regsvr32
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

FIN5

Score: 4.93
Matched TTPs:
  • T1487 - Disk Structure Wipe
  • T1547.011 - Plist Modification
MITREへのリンク →

Confucius

Score: 8.61
Matched TTPs:
  • T1487 - Disk Structure Wipe
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
  • T1665 - Hide Infrastructure
MITREへのリンク →

Patchwork

Score: 6.60
Matched TTPs:
  • T1487 - Disk Structure Wipe
  • T1497.002 - User Activity Based Checks
  • T1547.013 - XDG Autostart Entries
  • T1665 - Hide Infrastructure
MITREへのリンク →

Tropic Trooper

Score: 14.33
Matched TTPs:
  • T1487 - Disk Structure Wipe
  • T1055.004 - Asynchronous Procedure Call
  • T1136.003 - Cloud Account
  • T1547.013 - XDG Autostart Entries
  • T1665 - Hide Infrastructure
  • T1490 - Inhibit System Recovery
MITREへのリンク →

APT38

Score: 24.23
Matched TTPs:
  • T1566.001 - Spearphishing Attachment
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1590 - Gather Victim Network Information
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1493 - Transmitted Data Manipulation
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

TeamTNT

Score: 23.28
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1562.004 - Disable or Modify System Firewall
  • T1110.003 - Password Spraying
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1547.013 - XDG Autostart Entries
  • T1665 - Hide Infrastructure
MITREへのリンク →

Poseidon Group

Score: 5.06
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

admin@338

Score: 4.26
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Storm-1811

Score: 13.01
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1497.002 - User Activity Based Checks
  • T1027 - Obfuscated Files or Information
  • T1486 - Data Encrypted for Impact
  • T1030 - Data Transfer Size Limits
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

APT42

Score: 7.64
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1497.002 - User Activity Based Checks
  • T1030 - Data Transfer Size Limits
MITREへのリンク →

IndigoZebra

Score: 4.31
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

RedEcho

Score: 3.92
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

EXOTIC LILY

Score: 7.65
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1690 - Prevent Command History Logging
MITREへのリンク →

Silent Librarian

Score: 11.09
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
MITREへのリンク →

Moonstone Sleet

Score: 6.92
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1027 - Obfuscated Files or Information
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

CURIUM

Score: 4.60
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

Medusa Group

Score: 16.49
Matched TTPs:
  • T1218.003 - CMSTP
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

LAPSUS$

Score: 22.30
Matched TTPs:
  • T1547.005 - Security Support Provider
  • T1136.002 - Domain Account
  • T1609 - Container Administration Command
  • T1556.008 - Network Provider DLL
  • T1122 - Component Object Model Hijacking
  • T1030 - Data Transfer Size Limits
  • T1564.003 - Hidden Window
MITREへのリンク →

Salt Typhoon

Score: 6.19
Matched TTPs:
  • T1009 - Binary Padding
  • T1110.003 - Password Spraying
MITREへのリンク →

Rocke

Score: 9.65
Matched TTPs:
  • T1009 - Binary Padding
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Moses Staff

Score: 3.12
Matched TTPs:
  • T1009 - Binary Padding
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Velvet Ant

Score: 10.94
Matched TTPs:
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1490 - Inhibit System Recovery
MITREへのリンク →

BlackByte

Score: 12.19
Matched TTPs:
  • T1009 - Binary Padding
  • T1134.001 - Token Impersonation/Theft
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Volatile Cedar

Score: 3.37
Matched TTPs:
  • T1562.004 - Disable or Modify System Firewall
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Tonto Team

Score: 6.66
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1497.002 - User Activity Based Checks
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Deep Panda

Score: 6.83
Matched TTPs:
  • T1177 - LSASS Driver
  • T1497.002 - User Activity Based Checks
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Axiom

Score: 3.29
Matched TTPs:
  • T1177 - LSASS Driver
MITREへのリンク →

LuminousMoth

Score: 6.67
Matched TTPs:
  • T1136.002 - Domain Account
  • T1574.009 - Path Interception by Unquoted Path
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Metador

Score: 3.24
Matched TTPs:
  • T1136.002 - Domain Account
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Andariel

Score: 4.97
Matched TTPs:
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

BackdoorDiplomacy

Score: 4.97
Matched TTPs:
  • T1136.002 - Domain Account
  • T1055.004 - Asynchronous Procedure Call
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

POLONIUM

Score: 4.76
Matched TTPs:
  • T1608.005 - Link Target
  • T1122 - Component Object Model Hijacking
MITREへのリンク →

WIRTE

Score: 6.72
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

Blue Mockingbird

Score: 3.55
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1027.014 - Polymorphic Code
MITREへのリンク →

APT19

Score: 3.55
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Gorgon Group

Score: 3.37
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

FIN10

Score: 3.47
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1490 - Inhibit System Recovery
MITREへのリンク →

DarkVishnya

Score: 3.20
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

GOLD SOUTHFIELD

Score: 3.55
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1122 - Component Object Model Hijacking
MITREへのリンク →

Cinnamon Tempest

Score: 3.92
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

APT-C-36

Score: 3.17
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

TA551

Score: 3.52
Matched TTPs:
  • T1027.014 - Polymorphic Code
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

SideCopy

Score: 4.91
Matched TTPs:
  • T1584.002 - DNS Server
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

APT37

Score: 3.12
Matched TTPs:
  • T1027.004 - Compile After Delivery
  • T1547.013 - XDG Autostart Entries
MITREへのリンク →

PLATINUM

Score: 5.31
Matched TTPs:
  • T1547.013 - XDG Autostart Entries
  • T1686 - Disable or Modify System Firewall
MITREへのリンク →

APT18

Score: 4.62
Matched TTPs:
  • T1547.013 - XDG Autostart Entries
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.70
Matched TTPs:
  • T1490 - Inhibit System Recovery
  • T1027.014 - Polymorphic Code
  • T1546.011 - Application Shimming
  • T1098.007 - Additional Local or Domain Groups
  • T1654 - Log Enumeration
  • T1546.013 - PowerShell Profile
  • T1027.004 - Compile After Delivery
  • T1003.007 - Proc Filesystem
  • T1609 - Container Administration Command
  • T1546.008 - Accessibility Features
  • T1213.006 - Databases
  • T1665 - Hide Infrastructure
  • T1009 - Binary Padding
  • T1547.013 - XDG Autostart Entries
  • T1597 - Search Closed Sources
  • T1560.001 - Archive via Utility
  • T1053.007 - Container Orchestration Job
  • T1497.002 - User Activity Based Checks
  • T1690 - Prevent Command History Logging
  • T1030 - Data Transfer Size Limits
  • T1608.005 - Link Target
  • T1051 - Shared Webroot
  • T1183 - Image File Execution Options Injection
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る