Trusted Design

OPM Breach Analysis

概要

Back in February, the ThreatConnect team conducted an in-depth independent analysis of the Anthem breach, finding connections to amorphous Chinese APT activity. Although our primary concern at the time was with the malicious Wellpoint/Anthem and VAE, Inc. (a Federal contractor) command and control domains, we couldn’t help but notice a peculiar related OPM-themed domain, opm-learning[.]org. This finding was listed in our Anthem blog, and we have continued to monitor it in ThreatConnect since mid February.

Created: 2026-02-23

Indicators

類似Pulses

Domains associated with "Admedia" Wordpress compromises (score: 0.54)
Putter Panda activity (score: 0.53)
OilRig Deploys ALMA Communicator – DNS Tunneling Trojan (score: 0.53)
Locky Domain Analysis Uncovers Over 130 Related Indicators (score: 0.53)
Threat Group-3390 Targets Organizations for Cyberespionage (score: 0.52)

このPulseに関連する脅威アクター (事実ベース)

Contagious Interview

Score: 5.65

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1021.006 - Windows Remote Management

MITREへのリンク →

APT1

Score: 4.80

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1053.002 - At

MITREへのリンク →

APT32

Score: 3.92

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1027.007 - Dynamic API Resolution

MITREへのリンク →

Kimsuky

Score: 7.64

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1665 - Hide Infrastructure
T1053.002 - At

MITREへのリンク →

Dragonfly

Score: 5.36

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1193 - Spearphishing Attachment

MITREへのリンク →

Transparent Tribe

Score: 4.80

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1053.002 - At

MITREへのリンク →

ZIRCONIUM

Score: 4.11

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1578.001 - Create Snapshot

MITREへのリンク →

Mustang Panda

Score: 6.06

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1169 - Sudo

MITREへのリンク →

Lazarus Group

Score: 6.94

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1665 - Hide Infrastructure
T1578.001 - Create Snapshot

MITREへのリンク →

FIN7

Score: 6.51

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1027.007 - Dynamic API Resolution
T1578.001 - Create Snapshot

MITREへのリンク →

Magic Hound

Score: 4.80

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1053.002 - At

MITREへのリンク →

APT38

Score: 3.92

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1027.007 - Dynamic API Resolution

MITREへのリンク →

Moonstone Sleet

Score: 3.92

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1027.007 - Dynamic API Resolution

MITREへのリンク →

TeamTNT

Score: 4.35

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1665 - Hide Infrastructure

MITREへのリンク →

Sandworm Team

Score: 5.36

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1193 - Spearphishing Attachment

MITREへのリンク →

CURIUM

Score: 4.11

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1578.001 - Create Snapshot

MITREへのリンク →

UNC3886

Score: 6.72

Matched TTPs:

T1021.006 - Windows Remote Management
T1578.001 - Create Snapshot

MITREへのリンク →

LAPSUS$

Score: 3.84

Matched TTPs:

T1193 - Spearphishing Attachment

MITREへのリンク →

Axiom

Score: 4.54

Matched TTPs:

T1160 - Launch Daemon

MITREへのリンク →

Chimera

Score: 7.82

Matched TTPs:

T1027.007 - Dynamic API Resolution
T1665 - Hide Infrastructure
T1578.001 - Create Snapshot

MITREへのリンク →

Medusa Group

Score: 6.94

Matched TTPs:

T1027.007 - Dynamic API Resolution
T1094 - Custom Command and Control Protocol

MITREへのリンク →

Volt Typhoon

Score: 5.43

Matched TTPs:

T1665 - Hide Infrastructure
T1578.001 - Create Snapshot

MITREへのリンク →

Higaisa

Score: 5.43

Matched TTPs:

T1665 - Hide Infrastructure
T1578.001 - Create Snapshot

MITREへのリンク →

SideCopy

Score: 3.29

Matched TTPs:

T1053.002 - At

MITREへのリンク →

Mustard Tempest

Score: 3.29

Matched TTPs:

T1053.002 - At

MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Chimera

Score: 0.84

Matched TTPs:

T1665 - Hide Infrastructure
T1027.007 - Dynamic API Resolution
T1578.001 - Create Snapshot

MITREへのリンク →

Kimsuky

Score: 0.77

Matched TTPs:

T1665 - Hide Infrastructure
T1098.007 - Additional Local or Domain Groups
T1053.002 - At

MITREへのリンク →

Medusa Group

Score: 0.73

Matched TTPs:

T1027.007 - Dynamic API Resolution
T1094 - Custom Command and Control Protocol

MITREへのリンク →

Lazarus Group

Score: 0.72

Matched TTPs:

T1665 - Hide Infrastructure
T1098.007 - Additional Local or Domain Groups
T1578.001 - Create Snapshot

MITREへのリンク →

UNC3886

Score: 0.72

Matched TTPs:

T1021.006 - Windows Remote Management
T1578.001 - Create Snapshot

MITREへのリンク →

FIN7

Score: 0.71

Matched TTPs:

T1027.007 - Dynamic API Resolution
T1098.007 - Additional Local or Domain Groups
T1578.001 - Create Snapshot

MITREへのリンク →

Mustang Panda

Score: 0.64

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1169 - Sudo

MITREへのリンク →

Higaisa

Score: 0.61

Matched TTPs:

T1665 - Hide Infrastructure
T1578.001 - Create Snapshot

MITREへのリンク →

Volt Typhoon

Score: 0.60

Matched TTPs:

T1665 - Hide Infrastructure
T1578.001 - Create Snapshot

MITREへのリンク →

Contagious Interview

Score: 0.59

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1021.006 - Windows Remote Management

MITREへのリンク →

Sandworm Team

Score: 0.59

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1193 - Spearphishing Attachment

MITREへのリンク →

Dragonfly

Score: 0.58

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1193 - Spearphishing Attachment

MITREへのリンク →

APT1

Score: 0.57

Matched TTPs:

T1098.007 - Additional Local or Domain Groups
T1053.002 - At

MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクターグラフ

← Pulse一覧に戻る