Milan

ESET, noting that initial access to the network was achieved by means of spear-phishing as well as remote access and administration software like ITbrain and TeamViewer

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

Scheduled Task - T1053.005

Command and Scripting Interpreter: Visual Basic – T1059. Siamesekitten uses a malicious office Macro written in Visual Basic to install the malware.

Command and Scripting Interpreter: Windows Command Shell – T1059.003. Siamesekitten uses CMD commands to gain a foothold.

User Execution: Malicious File – T1204.002. Siamesekitten uses malicious files (Excel and Portable Executable) to drop the malware.

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

Scheduled Task - T1053.005

“Sandworm Team leveraged Scheduled Tasks through a Group Policy Object (GPO) to execute CaddyWiper at a predetermined time.” / “APT29 used scheduler and schtasks to create new tasks on remote host as part of their lateral movement… updating an existing legitimate task to execute their tools and then returned the scheduled task to its original configuration.”

Scheduled Task - T1053.005

The content repeatedly describes payloads, strings, configuration files, scripts, URLs, and binaries being obfuscated or encoded using Base64, XOR, RC4, AES, RSA, hex encoding, custom algorithms, and other methods across many malware families and threat actors.

The victim is contacted through social media. In this instance, the profile is impersonating a manager from ChipPc’s HR department... The victim is then directed to a website that is embedded with malware and is designed to impersonate the company’s legitimate website.

The content repeatedly describes threat actors and malware deleting files, tools, scripts, logs, droppers, staged data, and artifacts from compromised systems to cover tracks, remove evidence, or self-delete.

Deobfuscate/Decode Files or Information – T1140. Siamesekitten encodes their data in Base64, and uses passwords for files and macros.

The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

The content repeatedly describes malware and threat actors using commands and APIs such as ipconfig /all, ifconfig, arp -a, route print, nbtstat, netsh, GetAdaptersInfo, and GetIpNetTable to gather IP addresses, MAC addresses, DNS, DHCP, gateways, routing tables, ARP cache, proxy settings, domains, and network adapter/interface details.

The content repeatedly describes malware and threat actors collecting the username, identifying the current user, enumerating logged-on users, or running commands such as whoami, query user, and quser to determine user context on compromised systems.

The content repeatedly describes malware and threat actors collecting host details such as hostname, OS version, architecture, CPU, memory, BIOS, language, and other machine characteristics; e.g., "Action RAT has the ability to collect the hostname, OS version, and OS architecture of an infected host."

The malware gathers information concerning the machine, such as the machine’s name, what users are registered on it, and more.

The content repeatedly describes adversaries and malware storing collected data, command output, credentials, archives, or files in local temporary folders, working directories, hidden directories, registry locations, recycle bins, or specific files prior to exfiltration.

Initially, HTTP requests are sent to the C&C domain to download a malicious payload.

Application Layer Protocol: DNS – T107.004. Siamesekitten uses DNS Tunneling to communicate with the malware.

The Milan backdoor malware infects the computer or server after one or more lure files are downloaded... The DanBot RAT is downloaded to the infected system.

Data Encoding: Non-Standard Encoding – T1132.002. Siamesekitten encodes the data that is sent to the C2 based on their own protocol.

APT41 has used DGAs to change their C2 servers monthly. Aria-body has the ability to use a DGA for C2 communications. Astaroth has used a DGA in C2 communications. Bazar can implement DGA using the current date as a seed variable.

Many entries state malware or actors can upload, transfer, send, or exfiltrate files from compromised hosts to command-and-control servers or attacker infrastructure.