Trusted Design

TA2541

アクターID: G1018

· MITRE Pageへのリンク

脅威アクターの詳細

TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.(Citation: Proofpoint TA2541 February 2022)(Citation: Cisco Operation Layover September 2021)

脅威アクターの別名・別称

TA2541

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1047 - Windows Management Instrumentation
• T1491.002 - External Defacement
• T1099 - Timestomp
• T1218.013 - Mavinject
• T1087.002 - Domain Account
• T1543.003 - Windows Service
• T1598.003 - Spearphishing Link
• T1120 - Peripheral Device Discovery
• T1091 - Replication Through Removable Media
• T1098.007 - Additional Local or Domain Groups
• T1684 - Social Engineering
• T1136.002 - Domain Account
• T1036.002 - Right-to-Left Override
• T1218.012 - Verclsid
• T1608.005 - Link Target
• T1497.002 - User Activity Based Checks
• T1679 - Selective Exclusion
• T1199 - Trusted Relationship
• T1597 - Search Closed Sources
• T1001 - Data Obfuscation
• T1128 - Netsh Helper DLL
• T1506 - Web Session Cookie
• T1537 - Transfer Data to Cloud Account
• T1027.010 - Command Obfuscation
• T1547.013 - XDG Autostart Entries
• T1027.018 - Invisible Unicode
• T1546.017 - Udev Rules

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1027.018)
• CVE-2017-0143 (T1027.018)
• CVE-2016-1898 (T1027.018)
• CVE-2016-1897 (T1027.018)
• CVE-2015-0932 (T1001)
• CVE-2015-1770 (T1027.018)
• CVE-2015-2545 (T1027.018)
• CVE-2017-0199 (T1027.018)
• CVE-2012-0158 (T1027.018)
• CVE-2013-3906 (T1218.012)
• CVE-2014-6352 (T1027.010)
• CVE-2015-0016 (T1027.018)
• CVE-2010-3333 (T1027.018)
• CVE-2010-0188 (T1027.018)
• CVE-2010-2884 (T1597)
• CVE-2013-0640 (T1218.012)
• CVE-2011-0611 (T1597)
• CVE-2015-0071 (T1027.018)
• CVE-2010-1553 (T1027.018)
• CVE-2014-1761 (T1218.012)
• CVE-2015-2853 (T1027.018)
• CVE-2017-16929 (T1027.018)
• CVE-2012-1876 (T1027.018)
• CVE-2012-2539 (T1027.018)
• CVE-2013-3660 (T1027.018)
• CVE-2013-7331 (T1597)
• CVE-2009-3129 (T1027.018)
• CVE-2013-5990 (T1027.018)
• CVE-2015-0310 (T1597)
• CVE-2015-5119 (T1027.018)
• CVE-2015-5122 (T1027.018)
• CVE-2012-1856 (T1027.018)
• CVE-2015-2546 (T1027.018)
• CVE-2014-6332 (T1027.018)
• CVE-2015-3043 (T1027.018)
• CVE-2015-3090 (T1027.018)
• CVE-2015-2590 (T1027.018)
• CVE-2015-2424 (T1027.018)
• CVE-2015-0097 (T1027.018)
• CVE-2015-2502 (T1027.018)
• CVE-2014-6271 (T1027.018)
• CVE-2014-4113 (T1027.018)
• CVE-2012-1889 (T1218.012)
• CVE-2016-1010 (T1027.018)
• CVE-2016-0984 (T1027.018)
• CVE-2016-0998 (T1027.018)
• CVE-2015-1641 (T1027.018)
• CVE-2015-1701 (T1027.018)
• CVE-2015-0313 (T1027.018)
• CVE-2015-0359 (T1027.018)
• CVE-2014-0329 (T1027.018)
• CVE-2015-5130 (T1027.018)
• CVE-2015-5134 (T1027.018)
• CVE-2015-5539 (T1027.018)
• CVE-2015-5557 (T1027.018)
• CVE-2015-5563 (T1027.018)
• CVE-2015-5559 (T1027.018)
• CVE-2015-5540 (T1027.018)
• CVE-2015-5561 (T1027.018)
• CVE-2015-5551 (T1027.018)
• CVE-2015-5564 (T1027.018)
• CVE-2015-5565 (T1027.018)
• CVE-2015-5550 (T1027.018)
• CVE-2015-5566 (T1027.018)
• CVE-2015-5127 (T1027.018)
• CVE-2015-5556 (T1027.018)
• CVE-2015-3628 (T1001)
• CVE-2015-6034 (T1597)
• CVE-2015-2852 (T1027.018)
• CVE-2012-4969 (T1027.018)
• CVE-2015-6585 (T1091)
• CVE-2015-6022 (T1027.018)
• CVE-2015-8287 (T1091)
• CVE-2016-2343 (T1218.012)
• CVE-2017-0263 (T1027.018)
• CVE-2017-0261 (T1027.018)
• CVE-2017-0262 (T1027.018)
• CVE-2016-9494 (T1027.018)
• CVE-2016-9496 (T1027.018)
• CVE-2016-9495 (T1027.018)
• CVE-2025-55182 (T1027.018)
• CVE-2015-0311 (T1027.018)
• CVE-2010-3081 (T1218.012)
• CVE-2012-3213 (T1027.018)
• CVE-2012-4792 (T1027.018)
• CVE-2014-0322 (T1027.018)
• CVE-2015-0336 (T1027.018)
• CVE-2011-3544 (T1027.018)
• CVE-2014-7911 (T1597)
• CVE-2015-3636 (T1001)
• CVE-2013-6282 (T1597)
• CVE-2015-3105 (T1597)
• CVE-2017-17215 (T1027.018)
• CVE-2013-0074 (T1027.018)
• CVE-2012-0507 (T1027.018)
• CVE-2013-2465 (T1027.018)
• CVE-2013-2551 (T1027.018)
• CVE-2012-4681 (T1027.018)
• CVE-2014-1776 (T1027.018)
• CVE-2014-0556 (T1027.018)
• CVE-2015-0057 (T1027.018)
• CVE-2012-1723 (T1027.018)
• CVE-2015-1761 (T1027.018)
• CVE-2014-8440 (T1027.018)
• CVE-2010-0806 (T1027.018)
• CVE-2015-2360 (T1027.018)
• CVE-2014-4148 (T1027.018)
• CVE-2011-3402 (T1027.018)
• CVE-2014-6324 (T1027.018)
• CVE-2014-7247 (T1027.018)
• CVE-2013-2678 (T1027.018)
• CVE-2015-2426 (T1027.018)
• CVE-2008-1436 (T1597)
• CVE-2010-0232 (T1027.018)
• CVE-2010-4398 (T1027.018)
• CVE-2012-6422 (T1597)
• CVE-2013-2595 (T1597)
• CVE-2015-4902 (T1027.018)
• CVE-2014-3897 (T1027.018)
• CVE-2015-2387 (T1027.018)
• CVE-2010-2572 (T1027.018)
• CVE-2011-1255 (T1027.018)
• CVE-2017-8570 (T1027.018)
• CVE-2012-0611 (T1027.018)
• CVE-2015-2419 (T1027.018)
• CVE-2016-0189 (T1027.018)
• CVE-2016-4117 (T1218.012)
• CVE-2017-0001 (T1027.018)
• CVE-2023-1389 (T1027.018)
• CVE-2025-24893 (T1027.018)
• CVE-2025-31125 (T1027.018)
• CVE-2025-34026 (T1027.018)
• CVE-2025-55183 (T1027.018)
• CVE-2025-55184 (T1027.018)
• CVE-2025-66478 (T1098.007)
• CVE-2025-68645 (T1027.018)
• CVE-2026-20127 (T1027.018)
• CVE-2026-0723 (T1001)
• CVE-2015-5749 (T1218.012)
• CVE-2015-1427 (T1218.012)
• CVE-2015-3785 (T1597)
• CVE-2015-5897 (T1597)
• CVE-2015-7645 (T1027.018)
• CVE-2017-12149 (T1027.018)
• CVE-2015-3456 (T1597)
• CVE-2015-3113 (T1218.012)
• CVE-2015-5477 (T1218.012)
• CVE-2015-4495 (T1218.012)
• CVE-2013-2094 (T1027.018)
• CVE-2015-8562 (T1027.018)
• CVE-2015-7808 (T1218.012)
• CVE-2016-1990 (T1218.012)
• CVE-2016-1991 (T1001)
• CVE-2016-1019 (T1218.012)
• CVE-2015-2854 (T1027.018)
• CVE-2015-7755 (T1608.005)
• CVE-2016-1287 (T1597)
• CVE-2015-7261 (T1027.018)
• CVE-2015-6036 (T1027.018)
• CVE-2015-7262 (T1001)
• CVE-2016-1562 (T1001)
• CVE-2016-2342 (T1608.005)
• CVE-2016-6532 (T1218.012)
• CVE-2017-3212 (T1597)
• CVE-2012-0056 (T1218.012)
• CVE-2014-3153 (T1597)
• CVE-2014-4322 (T1597)
• CVE-2014-8361 (T1218.012)
• CVE-2014-8439 (T1218.012)
• CVE-2014-0515 (T1218.012)
• CVE-2014-9163 (T1218.012)
• CVE-2010-1297 (T1027.018)
• CVE-2010-2883 (T1218.012)
• CVE-2013-0634 (T1597)
• CVE-2012-5054 (T1218.012)
• CVE-2010-0738 (T1218.012)
• CVE-2013-0641 (T1218.012)
• CVE-2014-3393 (T1001)
• CVE-2014-2273 (T1597)
• CVE-2017-7255 (T1597)
• CVE-2025-13335 (T1001)
• CVE-2025-13927 (T1001)
• CVE-2025-13928 (T1001)
• CVE-2026-1102 (T1001)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る