Kinsing

"actors leverage legitimate credentials to log into external remote services"; "used legitimate credentials to gain initial access, maintain access, and exfiltrate data"; "used valid accounts for initial access and privilege escalation"

"actors leverage legitimate credentials to log into external remote services"; "connect remotely to victim networks using VPNs"; "used legitimate VPN, RDP, Citrix, or VNC credentials"; "used valid SSH credentials to access remote hosts"

Doki was executed through an open Docker daemon API port; Kinsing was executed in an Ubuntu container deployed via an open Docker daemon API; TeamTNT used tools (e.g., Weave Scope) to target exposed Docker API ports and gain initial access.

Examples include "CookieMiner has looked for files in the user's home directory with 'wallet' in their name using find .", "Kinsing has used the find command to search for specific files", and "APT41 has executed file /bin/pwd on exploited victims."

Red Canary detected an adversary executing discovery commands on dozens of cloud-based Linux endpoints vulnerable to a critical remote code vulnerability (CVE-2023-46604) in Apache ActiveMQ.

"actors leverage legitimate credentials to log into external remote services"; "used legitimate credentials to gain initial access, maintain access, and exfiltrate data"; "used valid accounts for initial access and privilege escalation"

"actors leverage legitimate credentials to log into external remote services"; "connect remotely to victim networks using VPNs"; "used legitimate VPN, RDP, Citrix, or VNC credentials"; "used valid SSH credentials to access remote hosts"

"actors leverage legitimate credentials to log into external remote services"; "used legitimate credentials to gain initial access, maintain access, and exfiltrate data"; "used valid accounts for initial access and privilege escalation"

"actors leverage legitimate credentials to log into external remote services"; "used legitimate credentials to gain initial access, maintain access, and exfiltrate data"; "used valid accounts for initial access and privilege escalation"

"Sandworm Team used a script to attempt RPC authentication against a number of hosts"; "Agrius engaged in various brute forcing activities via SMB"; "Chaos conducts brute force attacks against SSH services to gain initial access"; "Fox Kitten has brute forced RDP credentials"; "Turla may attempt to connect ... using net use commands and a predefined list ... of passwords."

Ebury has intercepted unencrypted private keys as well as private key pass-phrases. Hildegard has searched for private keys in .ssh. jRAT can steal keys for VPNs and cryptocurrency wallets. Kinsing has searched for private keys. Machete has scanned and looked for cryptographic keys and certificate file extensions. TeamTNT has searched for unsecured SSH keys. Troll Stealer collects all data in victim .ssh folders by creating a compressed copy that is subsequently exfiltrated.

Earth Lusca used the command powershell "Get-EventLog -LogName security -Newest 500 | where {$_.EventID -eq 4624} | format-list - property * | findstr "Address"" to find the network information of successfully logged-in accounts to discovery addresses of other machines.

During the 2015 Ukraine Electric Power Attack, Sandworm Team remotely discovered systems over LAN connections. OT systems were visible from the IT network as well, giving adversaries the ability to discover operational assets.

The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.

The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").

"used compromised credentials to log on to other systems"; "used compromised credentials to access other systems on a victim network"; "used valid SSH credentials to access remote hosts"

"used valid SSH credentials to access remote hosts"; "acquires valid SSH accounts through brute force"

The content repeatedly describes threat actors and malware using HTTP and HTTPS for command and control, such as: "Sandworm Team used BlackEnergy to communicate between compromised hosts and their command-and-control servers via HTTP post requests."

"remove known cryptojacking malware already in place"; "removal and evasion of Aliyun and Tencent cloud security software"; "targets Kinsing... and other... miners"