Loading malware…
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
BRONZE CANAL ... Tools ... Bifrose, Deuterbear, DRIGO, Flagpro, Gh0stTimes, KIVARS, PLEAD, Spiderpig, Waterbear, XBOW
SPIDERPIG RAT • Asynchronous designed HTTP custom backdoor – Observed since 2021/03
SPIDERPIG RAT • Asynchronous designed HTTP custom backdoor – Observed since 2021/03
11 distinct techniques documented for this family, organized by ATT&CK tactic.
A sophisticated hacking group tied to the government of China is exploiting routers in attacks on a variety of organizations... The group specifically targets “branch routers” — smaller appliances used at more remote branch offices to connect to a corporate headquarters.
MITRE ATT&CK Tactic Technique ID Procedure Initial Access Exploit Public-Facing Application T1190 Abuse ProxyLogon
SPIDERPIG x86 ... Reverse shell using powershell.exe
MITRE ATT&CK ... Execution User Execution: Malicious File T1204.002 User enables macro or run malicious program
MITRE ATT&CK ... Persistence Hijack Execution Flow: DLL Search Order Hijacking T1574.001 SPIDERPIG malicious FileSyncFalwb.dll in OneDrive install folder for persistence
MITRE ATT&CK ... Persistence Boot or Logon Initialization Scripts: Logon Script (Windows) T1037.001 SPIDERPIG uses UserInitMprLogonScript registry entry for persistence
Autorun types Type 1: Run / RunOnce / UserInitMprLogonScript Type 2: Run / OnecDrive / UserInitMprLogonScript
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
MITRE ATT&CK ... Persistence Boot or Logon Initialization Scripts: Logon Script (Windows) T1037.001 SPIDERPIG uses UserInitMprLogonScript registry entry for persistence
Autorun types Type 1: Run / RunOnce / UserInitMprLogonScript Type 2: Run / OnecDrive / UserInitMprLogonScript
MITRE ATT&CK ... Persistence Hijack Execution Flow: DLL Search Order Hijacking T1574.001 SPIDERPIG malicious FileSyncFalwb.dll in OneDrive install folder for persistence
DELTABEEF supports File manipulation (read / write / move / delete) ... TELESWORD commands REMOVEFILE, REMOVEDIR, MOVEFILE, COPYFILE
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
Specifically, upon gaining an initial foothold into a target network and gaining administrator access to network edge devices, BlackTech cyber actors often modify the firmware to hide their activity across the edge devices to further maintain persistence in the network.
MITRE ATT&CK ... Command and Control Application Layer Protocol: Web Protocols T1071.001 BUSYICE/SPIDERPIG uses HTTP/HTTPS for C&C communication
Download command “ExecYes”: download file from given URI ... TELESWORD command UPLOADFILE Download file from specified URL or Telegram storage ... SPIDERPIG x64 Download EXE and execute
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.