Sibot

The NOBELIUM APT ... is the threat actor that conducted supply chain attack against SolarWinds

The content repeatedly describes threat actors and malware using WMI/WMIC/wmiexec for remote execution, lateral movement, discovery, persistence, and administrative actions; e.g., 'APT41 used WMI in several ways, including for execution of commands via WMIEXEC as well as for persistence via PowerSploit' and 'Scattered Spider used Windows Management Instrumentation (WMI) to move laterally via Impacket.'

APT29 has been observed gaining persistence via backdoor and web shell malware variants, manipulating and adding accounts to compromised networks, conducting password spraying attacks to gain access to additional accounts, scheduled tasks, adding Registry Run keys, hijacking legitimate application-specific startup scripts to run malware on system startup, and WMI event subscriptions.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

MITRE ATT&CK Mappings: APT29 Execution T1059: Command and Scripting Interpreter .001: PowerShell .003: Windows Command Shell .005: Visual Basic .006: Python .009: Cloud API

APT-C-36 has embedded a VBScript within a malicious Word document which is executed upon the document opening.

APT29 has been observed gaining persistence via backdoor and web shell malware variants, manipulating and adding accounts to compromised networks, conducting password spraying attacks to gain access to additional accounts, scheduled tasks, adding Registry Run keys, hijacking legitimate application-specific startup scripts to run malware on system startup, and WMI event subscriptions.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

APT29 has been observed gaining persistence via backdoor and web shell malware variants, manipulating and adding accounts to compromised networks, conducting password spraying attacks to gain access to additional accounts, scheduled tasks, adding Registry Run keys, hijacking legitimate application-specific startup scripts to run malware on system startup, and WMI event subscriptions.

APT29 has been observed gaining persistence via backdoor and web shell malware variants, manipulating and adding accounts to compromised networks, conducting password spraying attacks to gain access to additional accounts, scheduled tasks, adding Registry Run keys, hijacking legitimate application-specific startup scripts to run malware on system startup, and WMI event subscriptions.

The content repeatedly describes malware and threat actors creating, modifying, or invoking Windows scheduled tasks via Task Scheduler or schtasks for persistence, execution, and lateral movement.

APT29 has been observed gaining persistence via backdoor and web shell malware variants, manipulating and adding accounts to compromised networks, conducting password spraying attacks to gain access to additional accounts, scheduled tasks, adding Registry Run keys, hijacking legitimate application-specific startup scripts to run malware on system startup, and WMI event subscriptions.

"Action RAT's commands, strings, and domains can be Base64 encoded within the payload." / "ADVSTORESHELL... strings... encrypted with an XOR-based algorithm; some strings are also encrypted with 3DES and reversed." / "APT29 has used encoded PowerShell commands." / "APT41 used VMProtected binaries..."

actors used the following command to rename one of their tools to a benign file name: ren "%temp%\upload" audiodg.exe ... APT1 ... used ... AcroRD32.exe ... as a name for malware ... APT28 ... changed extensions on files containing exfiltrated data to make them appear benign ... APT32 has renamed a NetCat binary to kb-10233.exe to masquerade as a Windows update.

APT5 has used the THINBLOOD utility to clear SSL VPN log files located at /home/runtime/logs.

The content repeatedly describes malware and threat actors deleting files, directories, droppers, logs, scripts, temporary files, exfiltrated archives, and uninstalling themselves to cover tracks or reduce forensic artifacts.

CSPY Downloader has the ability to remove values it writes to the Registry.

The content is a long ATT&CK-style listing of malware and threat groups that 'decrypt', 'decode', 'deobfuscate', 'unpack', or 'decompress' payloads, strings, configuration data, shellcode, and files prior to execution or use.

APT29 has use mshta to execute malicious scripts on a compromised host... APT32 has used mshta.exe for code execution... APT38 has used a renamed version of mshta.exe to execute malicious HTML files... FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.

ADVSTORESHELL is capable of setting and deleting Registry values. Agent Tesla can achieve persistence by modifying Registry key entries. APT41 used a malware variant called GOODLUCK to modify the registry in order to steal credentials.

The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."

AdFind can extract subnet information from Active Directory; actors used ipconfig /all after exploiting a machine; numerous malware and groups used ipconfig, ifconfig, arp, route, netsh, nbtstat, NBTscan, and related APIs to gather IP, MAC, DNS, DHCP, gateway, proxy, domain, ARP cache, routing, and adapter details.

The content is a long ATT&CK-style listing showing numerous malware families and threat groups that 'use HTTP,' 'use HTTPS,' 'HTTP POST requests,' 'HTTP GET requests,' or 'HTTP/S' for command and control communications.

The content repeatedly describes malware and threat actors that can "download files from C2," "download additional payloads," "upload and download files," "retrieve payloads from the C2 server," and "copy files to remote machines."