Trusted Design

Beyond Tax Returns: How Shared Malware Infrastructure Scales Brand Abuse In Indonesia

概要

A sophisticated fraud campaign exploiting Indonesia's tax season targeted 67 million residents through fake Coretax applications distributed via phishing websites and WhatsApp social engineering. The GoldFactory threat cluster orchestrated operations using Gigabud.RAT and MMRat malware families with shared infrastructure abusing over 16 trusted brands across government and financial sectors. The attack chain combines vishing, screen recording, and remote access capabilities to achieve device compromise and unauthorized financial transfers. Estimated financial impact reaches USD 1.5-2 million nationwide, with global implications extending to USD 6 million annually across multiple countries. The industrialized malware-as-a-service infrastructure enables horizontal scaling across Thailand, Vietnam, Philippines, and South Africa, demonstrating a shift toward unified cross-border operations that systematically undermine trust in digital government services.

Created: 2026-06-19

Indicators

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

APT32

Score: 32.73
Matched TTPs:
  • T1113 - Screen Capture
  • T1546.013 - PowerShell Profile
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1131 - Authentication Package
  • T1592.004 - Client Configurations
  • T1608.005 - Link Target
  • T1562.001 - Disable or Modify Tools
  • T1565 - Data Manipulation
  • T1027.014 - Polymorphic Code
  • T1027.018 - Invisible Unicode
  • T1556 - Modify Authentication Process
MITREへのリンク →

Turla

Score: 30.86
Matched TTPs:
  • T1113 - Screen Capture
  • T1546.013 - PowerShell Profile
  • T1099 - Timestomp
  • T1063 - Security Software Discovery
  • T1543.003 - Windows Service
  • T1003.007 - Proc Filesystem
  • T1131 - Authentication Package
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1218.001 - Compiled HTML File
  • T1027.004 - Compile After Delivery
  • T1027.018 - Invisible Unicode
MITREへのリンク →

APT28

Score: 28.66
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1098.007 - Additional Local or Domain Groups
  • T1131 - Authentication Package
  • T1562.004 - Disable or Modify System Firewall
  • T1547.011 - Plist Modification
  • T1608.005 - Link Target
  • T1574.009 - Path Interception by Unquoted Path
  • T1197 - BITS Jobs
  • T1027.018 - Invisible Unicode
  • T1055.008 - Ptrace System Calls
MITREへのリンク →

APT29

Score: 42.06
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1543.003 - Windows Service
  • T1562.004 - Disable or Modify System Firewall
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1592.004 - Client Configurations
  • T1568 - Dynamic Resolution
  • T1608.005 - Link Target
  • T1556.008 - Network Provider DLL
  • T1027.004 - Compile After Delivery
  • T1537 - Transfer Data to Cloud Account
  • T1027.018 - Invisible Unicode
  • T1547.008 - LSASS Driver
MITREへのリンク →

Scattered Spider

Score: 33.43
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
  • T1578 - Modify Cloud Compute Infrastructure
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1083 - File and Directory Discovery
  • T1556.008 - Network Provider DLL
  • T1597 - Search Closed Sources
  • T1565 - Data Manipulation
  • T1027 - Obfuscated Files or Information
  • T1197 - BITS Jobs
  • T1564.003 - Hidden Window
MITREへのリンク →

FIN4

Score: 6.94
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
  • T1543.003 - Windows Service
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Saint Bear

Score: 9.20
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1537 - Transfer Data to Cloud Account
  • T1027.018 - Invisible Unicode
MITREへのリンク →

FIN6

Score: 12.66
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1063 - Security Software Discovery
  • T1597 - Search Closed Sources
  • T1547.008 - LSASS Driver
  • T1556 - Modify Authentication Process
MITREへのリンク →

Sidewinder

Score: 4.78
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1543.003 - Windows Service
  • T1027.018 - Invisible Unicode
MITREへのリンク →

MoustachedBouncer

Score: 4.03
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1537 - Transfer Data to Cloud Account
MITREへのリンク →

MuddyWater

Score: 17.81
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1543.003 - Windows Service
  • T1518.002 - Backup Software Discovery
  • T1547.011 - Plist Modification
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Earth Lusca

Score: 23.23
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1543.003 - Windows Service
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1562.004 - Disable or Modify System Firewall
  • T1110.003 - Password Spraying
  • T1608.005 - Link Target
  • T1218.001 - Compiled HTML File
  • T1027.004 - Compile After Delivery
  • T1027.018 - Invisible Unicode
MITREへのリンク →

TA577

Score: 4.78
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1543.003 - Windows Service
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Winter Vivern

Score: 11.06
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1562.004 - Disable or Modify System Firewall
  • T1218.001 - Compiled HTML File
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Silence

Score: 7.12
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Contagious Interview

Score: 35.20
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1131 - Authentication Package
  • T1021.006 - Windows Remote Management
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1565 - Data Manipulation
  • T1027.004 - Compile After Delivery
  • T1126 - Network Share Connection Removal
  • T1027.018 - Invisible Unicode
  • T1547.008 - LSASS Driver
  • T1556 - Modify Authentication Process
MITREへのリンク →

LazyScripter

Score: 8.31
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1027.018 - Invisible Unicode
MITREへのリンク →

TA505

Score: 19.95
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1527 - Application Access Token
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1537 - Transfer Data to Cloud Account
  • T1027.018 - Invisible Unicode
MITREへのリンク →

FIN7

Score: 15.39
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1608.005 - Link Target
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Cobalt Group

Score: 16.20
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1543.003 - Windows Service
  • T1518.002 - Backup Software Discovery
  • T1598.004 - Spearphishing Voice
  • T1027.014 - Polymorphic Code
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Higaisa

Score: 4.81
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1665 - Hide Infrastructure
MITREへのリンク →

Kimsuky

Score: 46.24
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1213.006 - Databases
  • T1543.003 - Windows Service
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1131 - Authentication Package
  • T1546.008 - Accessibility Features
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1565 - Data Manipulation
  • T1027.014 - Polymorphic Code
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1537 - Transfer Data to Cloud Account
  • T1126 - Network Share Connection Removal
  • T1027.018 - Invisible Unicode
  • T1665 - Hide Infrastructure
MITREへのリンク →

Indrik Spider

Score: 8.63
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1003.007 - Proc Filesystem
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Molerats

Score: 4.78
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1543.003 - Windows Service
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Mustang Panda

Score: 23.86
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1169 - Sudo
  • T1136.003 - Cloud Account
  • T1055.005 - Thread Local Storage
  • T1027.018 - Invisible Unicode
  • T1556 - Modify Authentication Process
MITREへのリンク →

TA578

Score: 5.35
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Evilnum

Score: 4.78
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1543.003 - Windows Service
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Star Blizzard

Score: 8.76
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1565 - Data Manipulation
MITREへのリンク →

Magic Hound

Score: 39.43
Matched TTPs:
  • T1099 - Timestomp
  • T1578 - Modify Cloud Compute Infrastructure
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1547.005 - Security Support Provider
  • T1009 - Binary Padding
  • T1562.004 - Disable or Modify System Firewall
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1565 - Data Manipulation
  • T1027 - Obfuscated Files or Information
  • T1187 - Forced Authentication
  • T1027.018 - Invisible Unicode
  • T1547.008 - LSASS Driver
MITREへのリンク →

HEXANE

Score: 9.53
Matched TTPs:
  • T1099 - Timestomp
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1565 - Data Manipulation
MITREへのリンク →

Gamaredon Group

Score: 19.81
Matched TTPs:
  • T1099 - Timestomp
  • T1527 - Application Access Token
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1554 - Compromise Host Software Binary
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027.018 - Invisible Unicode
MITREへのリンク →

TA2541

Score: 12.93
Matched TTPs:
  • T1099 - Timestomp
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1537 - Transfer Data to Cloud Account
  • T1027.018 - Invisible Unicode
MITREへのリンク →

FIN13

Score: 12.40
Matched TTPs:
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1547.005 - Security Support Provider
  • T1134.001 - Token Impersonation/Theft
MITREへのリンク →

HAFNIUM

Score: 8.89
Matched TTPs:
  • T1099 - Timestomp
  • T1608.005 - Link Target
  • T1055.008 - Ptrace System Calls
MITREへのリンク →

Volt Typhoon

Score: 28.53
Matched TTPs:
  • T1099 - Timestomp
  • T1686.003 - Windows Host Firewall
  • T1003.007 - Proc Filesystem
  • T1547.005 - Security Support Provider
  • T1083 - File and Directory Discovery
  • T1488 - Disk Content Wipe
  • T1584.002 - DNS Server
  • T1537 - Transfer Data to Cloud Account
  • T1665 - Hide Infrastructure
MITREへのリンク →

FIN8

Score: 10.64
Matched TTPs:
  • T1099 - Timestomp
  • T1543.003 - Windows Service
  • T1027 - Obfuscated Files or Information
  • T1027.018 - Invisible Unicode
  • T1556 - Modify Authentication Process
MITREへのリンク →

Ember Bear

Score: 13.00
Matched TTPs:
  • T1578 - Modify Cloud Compute Infrastructure
  • T1584.008 - Network Devices
  • T1562.004 - Disable or Modify System Firewall
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Silent Librarian

Score: 8.98
Matched TTPs:
  • T1578 - Modify Cloud Compute Infrastructure
  • T1098.007 - Additional Local or Domain Groups
  • T1546.008 - Accessibility Features
MITREへのリンク →

Daggerfly

Score: 7.80
Matched TTPs:
  • T1584.008 - Network Devices
  • T1530 - Data from Cloud Storage
  • T1027.018 - Invisible Unicode
MITREへのリンク →

GALLIUM

Score: 7.39
Matched TTPs:
  • T1584.008 - Network Devices
  • T1547.011 - Plist Modification
  • T1537 - Transfer Data to Cloud Account
MITREへのリンク →

Dragonfly

Score: 15.52
Matched TTPs:
  • T1584.008 - Network Devices
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1562.004 - Disable or Modify System Firewall
  • T1531 - Account Access Removal
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Ke3chang

Score: 9.65
Matched TTPs:
  • T1584.008 - Network Devices
  • T1003.007 - Proc Filesystem
  • T1198 - SIP and Trust Provider Hijacking
MITREへのリンク →

Agrius

Score: 4.39
Matched TTPs:
  • T1584.008 - Network Devices
  • T1597 - Search Closed Sources
MITREへのリンク →

APT41

Score: 20.15
Matched TTPs:
  • T1584.008 - Network Devices
  • T1562.004 - Disable or Modify System Firewall
  • T1177 - LSASS Driver
  • T1027 - Obfuscated Files or Information
  • T1574.009 - Path Interception by Unquoted Path
  • T1564.003 - Hidden Window
  • T1537 - Transfer Data to Cloud Account
MITREへのリンク →

APT5

Score: 6.44
Matched TTPs:
  • T1584.008 - Network Devices
  • T1180 - Screensaver
MITREへのリンク →

menuPass

Score: 10.70
Matched TTPs:
  • T1584.008 - Network Devices
  • T1527 - Application Access Token
  • T1098.007 - Additional Local or Domain Groups
  • T1547.011 - Plist Modification
MITREへのリンク →

Threat Group-3390

Score: 13.73
Matched TTPs:
  • T1584.008 - Network Devices
  • T1098.007 - Additional Local or Domain Groups
  • T1218.003 - CMSTP
  • T1574.009 - Path Interception by Unquoted Path
  • T1537 - Transfer Data to Cloud Account
MITREへのリンク →

Wizard Spider

Score: 13.56
Matched TTPs:
  • T1584.008 - Network Devices
  • T1543.003 - Windows Service
  • T1083 - File and Directory Discovery
  • T1597 - Search Closed Sources
  • T1027.018 - Invisible Unicode
  • T1556 - Modify Authentication Process
MITREへのリンク →

Sandworm Team

Score: 41.44
Matched TTPs:
  • T1063 - Security Software Discovery
  • T1484.002 - Trust Modification
  • T1686.003 - Windows Host Firewall
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1562.004 - Disable or Modify System Firewall
  • T1546.008 - Accessibility Features
  • T1562.001 - Disable or Modify Tools
  • T1565 - Data Manipulation
  • T1027 - Obfuscated Files or Information
  • T1187 - Forced Authentication
  • T1075 - Pass the Hash
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Sea Turtle

Score: 12.89
Matched TTPs:
  • T1063 - Security Software Discovery
  • T1497.001 - System Checks
  • T1098.007 - Additional Local or Domain Groups
  • T1218 - System Binary Proxy Execution
MITREへのリンク →

Leviathan

Score: 24.11
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1562.004 - Disable or Modify System Firewall
  • T1554 - Compromise Host Software Binary
  • T1565 - Data Manipulation
  • T1027.014 - Polymorphic Code
  • T1488 - Disk Content Wipe
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Rocke

Score: 18.40
Matched TTPs:
  • T1180 - Screensaver
  • T1497.001 - System Checks
  • T1009 - Binary Padding
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027.004 - Compile After Delivery
  • T1537 - Transfer Data to Cloud Account
MITREへのリンク →

APT38

Score: 28.87
Matched TTPs:
  • T1180 - Screensaver
  • T1098.007 - Additional Local or Domain Groups
  • T1503 - Credentials from Web Browsers
  • T1009 - Binary Padding
  • T1590 - Gather Victim Network Information
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1493 - Transmitted Data Manipulation
  • T1537 - Transfer Data to Cloud Account
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Storm-0501

Score: 15.52
Matched TTPs:
  • T1686.003 - Windows Host Firewall
  • T1027 - Obfuscated Files or Information
  • T1027.014 - Polymorphic Code
  • T1537 - Transfer Data to Cloud Account
  • T1158 - Hidden Files and Directories
MITREへのリンク →

LuminousMoth

Score: 6.25
Matched TTPs:
  • T1543.003 - Windows Service
  • T1574.009 - Path Interception by Unquoted Path
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Confucius

Score: 7.65
Matched TTPs:
  • T1543.003 - Windows Service
  • T1608.005 - Link Target
  • T1027.018 - Invisible Unicode
  • T1665 - Hide Infrastructure
MITREへのリンク →

Elderwood

Score: 4.86
Matched TTPs:
  • T1543.003 - Windows Service
  • T1537 - Transfer Data to Cloud Account
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Machete

Score: 5.15
Matched TTPs:
  • T1543.003 - Windows Service
  • T1027.004 - Compile After Delivery
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Transparent Tribe

Score: 4.32
Matched TTPs:
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1027.018 - Invisible Unicode
MITREへのリンク →

APT3

Score: 10.89
Matched TTPs:
  • T1543.003 - Windows Service
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1537 - Transfer Data to Cloud Account
  • T1027.018 - Invisible Unicode
MITREへのリンク →

APT1

Score: 5.49
Matched TTPs:
  • T1543.003 - Windows Service
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
MITREへのリンク →

Lazarus Group

Score: 33.37
Matched TTPs:
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1547.011 - Plist Modification
  • T1608.005 - Link Target
  • T1069.001 - Local Groups
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1565 - Data Manipulation
  • T1055.005 - Thread Local Storage
  • T1665 - Hide Infrastructure
  • T1547.008 - LSASS Driver
  • T1556 - Modify Authentication Process
MITREへのリンク →

APT33

Score: 7.95
Matched TTPs:
  • T1543.003 - Windows Service
  • T1562.001 - Disable or Modify Tools
  • T1027.018 - Invisible Unicode
  • T1556 - Modify Authentication Process
MITREへのリンク →

ZIRCONIUM

Score: 14.17
Matched TTPs:
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1537 - Transfer Data to Cloud Account
  • T1027.018 - Invisible Unicode
MITREへのリンク →

EXOTIC LILY

Score: 9.19
Matched TTPs:
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1565 - Data Manipulation
  • T1027.018 - Invisible Unicode
  • T1547.008 - LSASS Driver
MITREへのリンク →

OilRig

Score: 14.46
Matched TTPs:
  • T1543.003 - Windows Service
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1027.018 - Invisible Unicode
  • T1547.008 - LSASS Driver
  • T1556 - Modify Authentication Process
MITREへのリンク →

Windshift

Score: 5.33
Matched TTPs:
  • T1543.003 - Windows Service
  • T1027.018 - Invisible Unicode
  • T1547.008 - LSASS Driver
MITREへのリンク →

RedCurl

Score: 8.77
Matched TTPs:
  • T1543.003 - Windows Service
  • T1016.002 - Wi-Fi Discovery
  • T1027.004 - Compile After Delivery
  • T1027.018 - Invisible Unicode
MITREへのリンク →

Storm-1811

Score: 12.37
Matched TTPs:
  • T1543.003 - Windows Service
  • T1098.007 - Additional Local or Domain Groups
  • T1027 - Obfuscated Files or Information
  • T1486 - Data Encrypted for Impact
  • T1547.008 - LSASS Driver
MITREへのリンク →

Patchwork

Score: 11.54
Matched TTPs:
  • T1543.003 - Windows Service
  • T1530 - Data from Cloud Storage
  • T1537 - Transfer Data to Cloud Account
  • T1027.018 - Invisible Unicode
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT39

Score: 9.95
Matched TTPs:
  • T1543.003 - Windows Service
  • T1547.011 - Plist Modification
  • T1027.004 - Compile After Delivery
  • T1537 - Transfer Data to Cloud Account
  • T1027.018 - Invisible Unicode
MITREへのリンク →

TeamTNT

Score: 23.12
Matched TTPs:
  • T1497.001 - System Checks
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1562.004 - Disable or Modify System Firewall
  • T1110.003 - Password Spraying
  • T1597 - Search Closed Sources
  • T1537 - Transfer Data to Cloud Account
  • T1665 - Hide Infrastructure
MITREへのリンク →

Salt Typhoon

Score: 12.55
Matched TTPs:
  • T1497.001 - System Checks
  • T1009 - Binary Padding
  • T1110.003 - Password Spraying
  • T1556 - Modify Authentication Process
MITREへのリンク →

BRONZE BUTLER

Score: 10.51
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1592.004 - Client Configurations
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Aquatic Panda

Score: 6.91
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1562.004 - Disable or Modify System Firewall
  • T1597 - Search Closed Sources
MITREへのリンク →

Chimera

Score: 9.89
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1574 - Hijack Execution Flow
  • T1665 - Hide Infrastructure
MITREへのリンク →

PROMETHIUM

Score: 3.84
Matched TTPs:
  • T1530 - Data from Cloud Storage
MITREへのリンク →

Akira

Score: 8.68
Matched TTPs:
  • T1137.005 - Outlook Rules
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

IndigoZebra

Score: 3.53
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
MITREへのリンク →

RedEcho

Score: 3.92
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Moonstone Sleet

Score: 16.01
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1565 - Data Manipulation
  • T1027 - Obfuscated Files or Information
  • T1197 - BITS Jobs
  • T1126 - Network Share Connection Removal
  • T1547.008 - LSASS Driver
MITREへのリンク →

CURIUM

Score: 10.00
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1218.001 - Compiled HTML File
  • T1565 - Data Manipulation
  • T1547.008 - LSASS Driver
MITREへのリンク →

UNC3886

Score: 18.59
Matched TTPs:
  • T1218 - System Binary Proxy Execution
  • T1009 - Binary Padding
  • T1021.006 - Windows Remote Management
  • T1597 - Search Closed Sources
  • T1488 - Disk Content Wipe
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Medusa Group

Score: 17.02
Matched TTPs:
  • T1218.003 - CMSTP
  • T1009 - Binary Padding
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1565 - Data Manipulation
  • T1027 - Obfuscated Files or Information
  • T1537 - Transfer Data to Cloud Account
MITREへのリンク →

LAPSUS$

Score: 10.62
Matched TTPs:
  • T1547.005 - Security Support Provider
  • T1556.008 - Network Provider DLL
  • T1564.003 - Hidden Window
MITREへのリンク →

ToddyCat

Score: 7.70
Matched TTPs:
  • T1009 - Binary Padding
  • T1665 - Hide Infrastructure
  • T1547.008 - LSASS Driver
MITREへのリンク →

Velvet Ant

Score: 6.54
Matched TTPs:
  • T1009 - Binary Padding
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

BlackByte

Score: 10.61
Matched TTPs:
  • T1009 - Binary Padding
  • T1134.001 - Token Impersonation/Theft
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

SilverTerrier

Score: 3.29
Matched TTPs:
  • T1131 - Authentication Package
MITREへのリンク →

Tonto Team

Score: 5.09
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Deep Panda

Score: 6.03
Matched TTPs:
  • T1177 - LSASS Driver
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Axiom

Score: 3.29
Matched TTPs:
  • T1177 - LSASS Driver
MITREへのリンク →

Fox Kitten

Score: 5.63
Matched TTPs:
  • T1177 - LSASS Driver
  • T1565 - Data Manipulation
MITREへのリンク →

INC Ransom

Score: 7.76
Matched TTPs:
  • T1083 - File and Directory Discovery
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Tropic Trooper

Score: 6.97
Matched TTPs:
  • T1136.003 - Cloud Account
  • T1665 - Hide Infrastructure
MITREへのリンク →

Play

Score: 5.24
Matched TTPs:
  • T1597 - Search Closed Sources
  • T1574.009 - Path Interception by Unquoted Path
MITREへのリンク →

WIRTE

Score: 5.14
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
MITREへのリンク →

DarkVishnya

Score: 6.94
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1213.003 - Code Repositories
MITREへのリンク →

Water Galura

Score: 4.68
Matched TTPs:
  • T1565 - Data Manipulation
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

DarkHydrus

Score: 4.13
Matched TTPs:
  • T1531 - Account Access Removal
MITREへのリンク →

Andariel

Score: 3.84
Matched TTPs:
  • T1187 - Forced Authentication
MITREへのリンク →

SideCopy

Score: 4.13
Matched TTPs:
  • T1584.002 - DNS Server
MITREへのリンク →

Dark Caracal

Score: 4.58
Matched TTPs:
  • T1537 - Transfer Data to Cloud Account
  • T1547.008 - LSASS Driver
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.70
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1213.006 - Databases
  • T1543.003 - Windows Service
  • T1565 - Data Manipulation
  • T1126 - Network Share Connection Removal
  • T1597 - Search Closed Sources
  • T1027.014 - Polymorphic Code
  • T1537 - Transfer Data to Cloud Account
  • T1027.004 - Compile After Delivery
  • T1546.008 - Accessibility Features
  • T1098.007 - Additional Local or Domain Groups
  • T1197 - BITS Jobs
  • T1027.018 - Invisible Unicode
  • T1009 - Binary Padding
  • T1608.005 - Link Target
  • T1003.007 - Proc Filesystem
  • T1131 - Authentication Package
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT29

Score: 0.64
Matched TTPs:
  • T1543.003 - Windows Service
  • T1099 - Timestomp
  • T1568 - Dynamic Resolution
  • T1556.008 - Network Provider DLL
  • T1584.008 - Network Devices
  • T1547.011 - Plist Modification
  • T1537 - Transfer Data to Cloud Account
  • T1222.002 - Linux and Mac Permissions
  • T1027.004 - Compile After Delivery
  • T1547.008 - LSASS Driver
  • T1027.018 - Invisible Unicode
  • T1177 - LSASS Driver
  • T1562.004 - Disable or Modify System Firewall
  • T1608.005 - Link Target
  • T1592.004 - Client Configurations
MITREへのリンク →

Sandworm Team

Score: 0.63
Matched TTPs:
  • T1565 - Data Manipulation
  • T1543.003 - Windows Service
  • T1075 - Pass the Hash
  • T1063 - Security Software Discovery
  • T1562.004 - Disable or Modify System Firewall
  • T1562.001 - Disable or Modify Tools
  • T1187 - Forced Authentication
  • T1546.008 - Accessibility Features
  • T1098.007 - Additional Local or Domain Groups
  • T1027.018 - Invisible Unicode
  • T1016.002 - Wi-Fi Discovery
  • T1484.002 - Trust Modification
  • T1686.003 - Windows Host Firewall
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Magic Hound

Score: 0.60
Matched TTPs:
  • T1565 - Data Manipulation
  • T1099 - Timestomp
  • T1543.003 - Windows Service
  • T1562.004 - Disable or Modify System Firewall
  • T1578 - Modify Cloud Compute Infrastructure
  • T1562.001 - Disable or Modify Tools
  • T1597 - Search Closed Sources
  • T1547.005 - Security Support Provider
  • T1187 - Forced Authentication
  • T1547.008 - LSASS Driver
  • T1098.007 - Additional Local or Domain Groups
  • T1027.018 - Invisible Unicode
  • T1016.002 - Wi-Fi Discovery
  • T1009 - Binary Padding
  • T1608.005 - Link Target
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ


← Pulse一覧に戻る