Trusted Design

A stealthy RAT burrowing deep into Android devices

概要

BTMOB is an Android remote access trojan that evolved from SpySolr malware and poses significant threats beyond traditional banking trojans. The malware combines phishing-led delivery with an APK builder interface that enables rapid payload generation without coding skills. Distributed through fake app stores impersonating streaming services, cryptocurrency platforms, and government agencies, BTMOB abuses Android Accessibility Services to gain elevated permissions. Marketed as malware-as-a-service with a reported $5,000 lifetime license, it provides adversaries with capabilities to exfiltrate sensitive data, capture screenshots, record device activity, and establish remote control. The tool's customizable phishing lures have been adapted for specific regions, including campaigns impersonating Argentine tax authorities, making it a rapidly evolving threat with global reach.

Created: 2026-06-01

Indicators

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

APT32

Score: 29.99
Matched TTPs:
  • T1113 - Screen Capture
  • T1546.013 - PowerShell Profile
  • T1547.005 - Security Support Provider
  • T1131 - Authentication Package
  • T1055.013 - Process Doppelgänging
  • T1592.004 - Client Configurations
  • T1055.004 - Asynchronous Procedure Call
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
  • T1601.001 - Patch System Image
  • T1556 - Modify Authentication Process
MITREへのリンク →

Turla

Score: 29.13
Matched TTPs:
  • T1113 - Screen Capture
  • T1546.013 - PowerShell Profile
  • T1099 - Timestomp
  • T1063 - Security Software Discovery
  • T1131 - Authentication Package
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1218.001 - Compiled HTML File
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
  • T1601.001 - Patch System Image
MITREへのリンク →

APT28

Score: 22.27
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1131 - Authentication Package
  • T1547.011 - Plist Modification
  • T1197 - BITS Jobs
  • T1585 - Establish Accounts
  • T1055.008 - Ptrace System Calls
MITREへのリンク →

APT29

Score: 34.20
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1202 - Indirect Command Execution
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1592.004 - Client Configurations
  • T1556.008 - Network Provider DLL
  • T1015 - Accessibility Features
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Contagious Interview

Score: 33.05
Matched TTPs:
  • T1044 - File System Permissions Weakness
  • T1546.013 - PowerShell Profile
  • T1547.005 - Security Support Provider
  • T1131 - Authentication Package
  • T1021.006 - Windows Remote Management
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1056 - Input Capture
  • T1030 - Data Transfer Size Limits
  • T1027.004 - Compile After Delivery
  • T1601.001 - Patch System Image
  • T1556 - Modify Authentication Process
MITREへのリンク →

Scattered Spider

Score: 37.57
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
  • T1109 - Component Firmware
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1547.005 - Security Support Provider
  • T1535 - Unused/Unsupported Cloud Regions
  • T1609 - Container Administration Command
  • T1556.008 - Network Provider DLL
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1056 - Input Capture
  • T1030 - Data Transfer Size Limits
  • T1197 - BITS Jobs
MITREへのリンク →

FIN4

Score: 4.13
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
MITREへのリンク →

Saint Bear

Score: 9.14
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1055.013 - Process Doppelgänging
  • T1597 - Search Closed Sources
  • T1030 - Data Transfer Size Limits
MITREへのリンク →

FIN6

Score: 14.34
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1063 - Security Software Discovery
  • T1055.013 - Process Doppelgänging
  • T1597 - Search Closed Sources
  • T1601.001 - Patch System Image
  • T1556 - Modify Authentication Process
MITREへのリンク →

Sidewinder

Score: 7.12
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1090 - Proxy
  • T1601.001 - Patch System Image
MITREへのリンク →

MuddyWater

Score: 12.46
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1601.001 - Patch System Image
MITREへのリンク →

Earth Lusca

Score: 15.53
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1110.003 - Password Spraying
  • T1055.004 - Asynchronous Procedure Call
  • T1218.001 - Compiled HTML File
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Winter Vivern

Score: 11.22
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1055.013 - Process Doppelgänging
  • T1090 - Proxy
  • T1218.001 - Compiled HTML File
MITREへのリンク →

Silence

Score: 8.98
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
  • T1562.001 - Disable or Modify Tools
  • T1601.001 - Patch System Image
MITREへのリンク →

LazyScripter

Score: 3.84
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1601.001 - Patch System Image
MITREへのリンク →

TA505

Score: 15.44
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1527 - Application Access Token
  • T1016.002 - Wi-Fi Discovery
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1601.001 - Patch System Image
MITREへのリンク →

FIN7

Score: 15.27
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1009 - Binary Padding
  • T1055.013 - Process Doppelgänging
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1056 - Input Capture
  • T1601.001 - Patch System Image
MITREへのリンク →

Cobalt Group

Score: 11.12
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1598.004 - Spearphishing Voice
  • T1027.014 - Polymorphic Code
  • T1601.001 - Patch System Image
MITREへのリンク →

Kimsuky

Score: 35.84
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1109 - Component Firmware
  • T1213.006 - Databases
  • T1009 - Binary Padding
  • T1131 - Authentication Package
  • T1609 - Container Administration Command
  • T1597 - Search Closed Sources
  • T1027.014 - Polymorphic Code
  • T1056 - Input Capture
  • T1030 - Data Transfer Size Limits
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1601.001 - Patch System Image
MITREへのリンク →

Indrik Spider

Score: 8.12
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1056 - Input Capture
MITREへのリンク →

Leafminer

Score: 8.37
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1101 - Security Support Provider
  • T1601.001 - Patch System Image
MITREへのリンク →

Mustang Panda

Score: 23.61
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1055.013 - Process Doppelgänging
  • T1055.004 - Asynchronous Procedure Call
  • T1169 - Sudo
  • T1136.003 - Cloud Account
  • T1056 - Input Capture
  • T1055.005 - Thread Local Storage
  • T1556 - Modify Authentication Process
MITREへのリンク →

Evilnum

Score: 5.01
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1109 - Component Firmware
MITREへのリンク →

Star Blizzard

Score: 11.37
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1109 - Component Firmware
  • T1547.005 - Security Support Provider
  • T1609 - Container Administration Command
MITREへのリンク →

LuminousMoth

Score: 5.05
Matched TTPs:
  • T1109 - Component Firmware
  • T1056 - Input Capture
MITREへのリンク →

Sandworm Team

Score: 26.37
Matched TTPs:
  • T1109 - Component Firmware
  • T1063 - Security Software Discovery
  • T1484.002 - Trust Modification
  • T1016.002 - Wi-Fi Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1049 - System Network Connections Discovery
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1601.001 - Patch System Image
MITREへのリンク →

Lotus Blossom

Score: 7.51
Matched TTPs:
  • T1109 - Component Firmware
  • T1099 - Timestomp
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

APT42

Score: 6.07
Matched TTPs:
  • T1109 - Component Firmware
  • T1030 - Data Transfer Size Limits
MITREへのリンク →

Magic Hound

Score: 21.77
Matched TTPs:
  • T1099 - Timestomp
  • T1016.002 - Wi-Fi Discovery
  • T1547.005 - Security Support Provider
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1601.001 - Patch System Image
MITREへのリンク →

HEXANE

Score: 11.29
Matched TTPs:
  • T1099 - Timestomp
  • T1547.005 - Security Support Provider
  • T1055.004 - Asynchronous Procedure Call
  • T1056 - Input Capture
  • T1601.001 - Patch System Image
MITREへのリンク →

Gamaredon Group

Score: 20.07
Matched TTPs:
  • T1099 - Timestomp
  • T1527 - Application Access Token
  • T1090 - Proxy
  • T1554 - Compromise Host Software Binary
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1601.001 - Patch System Image
MITREへのリンク →

TA2541

Score: 4.54
Matched TTPs:
  • T1099 - Timestomp
  • T1597 - Search Closed Sources
MITREへのリンク →

FIN13

Score: 14.13
Matched TTPs:
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1547.005 - Security Support Provider
  • T1055.004 - Asynchronous Procedure Call
  • T1134.001 - Token Impersonation/Theft
MITREへのリンク →

HAFNIUM

Score: 16.65
Matched TTPs:
  • T1099 - Timestomp
  • T1049 - System Network Connections Discovery
  • T1056 - Input Capture
  • T1518.001 - Security Software Discovery
  • T1055.008 - Ptrace System Calls
MITREへのリンク →

Volt Typhoon

Score: 22.45
Matched TTPs:
  • T1099 - Timestomp
  • T1547.005 - Security Support Provider
  • T1535 - Unused/Unsupported Cloud Regions
  • T1055.004 - Asynchronous Procedure Call
  • T1049 - System Network Connections Discovery
  • T1488 - Disk Content Wipe
  • T1584.002 - DNS Server
MITREへのリンク →

FIN8

Score: 9.70
Matched TTPs:
  • T1099 - Timestomp
  • T1027 - Obfuscated Files or Information
  • T1601.001 - Patch System Image
  • T1556 - Modify Authentication Process
MITREへのリンク →

Daggerfly

Score: 6.44
Matched TTPs:
  • T1584.008 - Network Devices
  • T1530 - Data from Cloud Storage
MITREへのリンク →

GALLIUM

Score: 7.07
Matched TTPs:
  • T1584.008 - Network Devices
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Dragonfly

Score: 9.61
Matched TTPs:
  • T1584.008 - Network Devices
  • T1009 - Binary Padding
  • T1055.013 - Process Doppelgänging
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Ke3chang

Score: 14.49
Matched TTPs:
  • T1584.008 - Network Devices
  • T1055.013 - Process Doppelgänging
  • T1198 - SIP and Trust Provider Hijacking
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Agrius

Score: 4.39
Matched TTPs:
  • T1584.008 - Network Devices
  • T1597 - Search Closed Sources
MITREへのリンク →

APT41

Score: 12.99
Matched TTPs:
  • T1584.008 - Network Devices
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1027 - Obfuscated Files or Information
  • T1030 - Data Transfer Size Limits
MITREへのリンク →

APT5

Score: 8.17
Matched TTPs:
  • T1584.008 - Network Devices
  • T1180 - Screensaver
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

menuPass

Score: 10.92
Matched TTPs:
  • T1584.008 - Network Devices
  • T1527 - Application Access Token
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Threat Group-3390

Score: 10.47
Matched TTPs:
  • T1584.008 - Network Devices
  • T1218.003 - CMSTP
  • T1055.004 - Asynchronous Procedure Call
  • T1056 - Input Capture
MITREへのリンク →

Wizard Spider

Score: 11.01
Matched TTPs:
  • T1584.008 - Network Devices
  • T1597 - Search Closed Sources
  • T1056 - Input Capture
  • T1601.001 - Patch System Image
  • T1556 - Modify Authentication Process
MITREへのリンク →

Ember Bear

Score: 8.80
Matched TTPs:
  • T1584.008 - Network Devices
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1056 - Input Capture
MITREへのリンク →

Storm-0501

Score: 18.80
Matched TTPs:
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1535 - Unused/Unsupported Cloud Regions
  • T1027 - Obfuscated Files or Information
  • T1027.014 - Polymorphic Code
  • T1056 - Input Capture
  • T1518.001 - Security Software Discovery
MITREへのリンク →

Sea Turtle

Score: 3.62
Matched TTPs:
  • T1063 - Security Software Discovery
MITREへのリンク →

Leviathan

Score: 16.87
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1554 - Compromise Host Software Binary
  • T1027.014 - Polymorphic Code
  • T1488 - Disk Content Wipe
  • T1056 - Input Capture
MITREへのリンク →

Rocke

Score: 16.16
Matched TTPs:
  • T1180 - Screensaver
  • T1009 - Binary Padding
  • T1535 - Unused/Unsupported Cloud Regions
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027.004 - Compile After Delivery
MITREへのリンク →

APT38

Score: 24.98
Matched TTPs:
  • T1180 - Screensaver
  • T1566.001 - Spearphishing Attachment
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1590 - Gather Victim Network Information
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1493 - Transmitted Data Manipulation
MITREへのリンク →

APT39

Score: 11.27
Matched TTPs:
  • T1566.001 - Spearphishing Attachment
  • T1547.011 - Plist Modification
  • T1055.013 - Process Doppelgänging
  • T1027.004 - Compile After Delivery
MITREへのリンク →

OilRig

Score: 17.55
Matched TTPs:
  • T1566.001 - Spearphishing Attachment
  • T1009 - Binary Padding
  • T1055.013 - Process Doppelgänging
  • T1055.004 - Asynchronous Procedure Call
  • T1592.002 - Software
  • T1556 - Modify Authentication Process
MITREへのリンク →

PROMETHIUM

Score: 3.84
Matched TTPs:
  • T1530 - Data from Cloud Storage
MITREへのリンク →

Patchwork

Score: 5.71
Matched TTPs:
  • T1530 - Data from Cloud Storage
  • T1601.001 - Patch System Image
MITREへのリンク →

Akira

Score: 10.69
Matched TTPs:
  • T1137.005 - Outlook Rules
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1056 - Input Capture
MITREへのリンク →

RedCurl

Score: 9.25
Matched TTPs:
  • T1016.002 - Wi-Fi Discovery
  • T1090 - Proxy
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Medusa Group

Score: 14.49
Matched TTPs:
  • T1218.003 - CMSTP
  • T1009 - Binary Padding
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1056 - Input Capture
  • T1601.001 - Patch System Image
MITREへのリンク →

LAPSUS$

Score: 17.38
Matched TTPs:
  • T1547.005 - Security Support Provider
  • T1609 - Container Administration Command
  • T1556.008 - Network Provider DLL
  • T1015 - Accessibility Features
  • T1030 - Data Transfer Size Limits
MITREへのリンク →

Salt Typhoon

Score: 8.93
Matched TTPs:
  • T1009 - Binary Padding
  • T1110.003 - Password Spraying
  • T1556 - Modify Authentication Process
MITREへのリンク →

TeamTNT

Score: 13.16
Matched TTPs:
  • T1009 - Binary Padding
  • T1535 - Unused/Unsupported Cloud Regions
  • T1110.003 - Password Spraying
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
MITREへのリンク →

ToddyCat

Score: 6.09
Matched TTPs:
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1056 - Input Capture
MITREへのリンク →

UNC3886

Score: 14.46
Matched TTPs:
  • T1009 - Binary Padding
  • T1021.006 - Windows Remote Management
  • T1597 - Search Closed Sources
  • T1488 - Disk Content Wipe
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Lazarus Group

Score: 22.43
Matched TTPs:
  • T1009 - Binary Padding
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1069.001 - Local Groups
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1055.005 - Thread Local Storage
  • T1556 - Modify Authentication Process
MITREへのリンク →

Velvet Ant

Score: 8.27
Matched TTPs:
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

BlackByte

Score: 10.61
Matched TTPs:
  • T1009 - Binary Padding
  • T1134.001 - Token Impersonation/Theft
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

SilverTerrier

Score: 3.29
Matched TTPs:
  • T1131 - Authentication Package
MITREへのリンク →

FIN5

Score: 5.09
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1055.013 - Process Doppelgänging
MITREへのリンク →

Tonto Team

Score: 5.09
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1027.004 - Compile After Delivery
MITREへのリンク →

APT3

Score: 7.77
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Deep Panda

Score: 6.03
Matched TTPs:
  • T1177 - LSASS Driver
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Axiom

Score: 6.91
Matched TTPs:
  • T1177 - LSASS Driver
  • T1049 - System Network Connections Discovery
MITREへのリンク →

Fox Kitten

Score: 7.49
Matched TTPs:
  • T1177 - LSASS Driver
  • T1055.013 - Process Doppelgänging
  • T1601.001 - Patch System Image
MITREへのリンク →

APT19

Score: 6.95
Matched TTPs:
  • T1055.013 - Process Doppelgänging
  • T1027.014 - Polymorphic Code
  • T1601.001 - Patch System Image
MITREへのリンク →

APT37

Score: 4.68
Matched TTPs:
  • T1055.013 - Process Doppelgänging
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Tropic Trooper

Score: 9.15
Matched TTPs:
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
  • T1136.003 - Cloud Account
MITREへのリンク →

BRONZE BUTLER

Score: 7.98
Matched TTPs:
  • T1592.004 - Client Configurations
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Silent Librarian

Score: 3.44
Matched TTPs:
  • T1609 - Container Administration Command
MITREへのリンク →

Chimera

Score: 10.15
Matched TTPs:
  • T1055.004 - Asynchronous Procedure Call
  • T1574 - Hijack Execution Flow
  • T1056 - Input Capture
  • T1601.001 - Patch System Image
MITREへのリンク →

INC Ransom

Score: 5.87
Matched TTPs:
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Play

Score: 3.66
Matched TTPs:
  • T1597 - Search Closed Sources
  • T1601.001 - Patch System Image
MITREへのリンク →

Aquatic Panda

Score: 3.66
Matched TTPs:
  • T1597 - Search Closed Sources
  • T1601.001 - Patch System Image
MITREへのリンク →

CURIUM

Score: 3.62
Matched TTPs:
  • T1218.001 - Compiled HTML File
MITREへのリンク →

WIRTE

Score: 5.14
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
MITREへのリンク →

APT33

Score: 5.14
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1556 - Modify Authentication Process
MITREへのリンク →

Storm-1811

Score: 9.91
Matched TTPs:
  • T1027 - Obfuscated Files or Information
  • T1486 - Data Encrypted for Impact
  • T1030 - Data Transfer Size Limits
MITREへのリンク →

Moonstone Sleet

Score: 5.78
Matched TTPs:
  • T1027 - Obfuscated Files or Information
  • T1197 - BITS Jobs
MITREへのリンク →

TA551

Score: 4.61
Matched TTPs:
  • T1027.014 - Polymorphic Code
  • T1601.001 - Patch System Image
MITREへのリンク →

Cinnamon Tempest

Score: 4.35
Matched TTPs:
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
MITREへのリンク →

ZIRCONIUM

Score: 7.79
Matched TTPs:
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
MITREへのリンク →

SideCopy

Score: 4.13
Matched TTPs:
  • T1584.002 - DNS Server
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Scattered Spider

Score: 0.70
Matched TTPs:
  • T1556.008 - Network Provider DLL
  • T1597 - Search Closed Sources
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1535 - Unused/Unsupported Cloud Regions
  • T1056 - Input Capture
  • T1609 - Container Administration Command
  • T1197 - BITS Jobs
  • T1027 - Obfuscated Files or Information
  • T1109 - Component Firmware
  • T1030 - Data Transfer Size Limits
  • T1666 - Modify Cloud Resource Hierarchy
  • T1547.005 - Security Support Provider
MITREへのリンク →

Kimsuky

Score: 0.67
Matched TTPs:
  • T1131 - Authentication Package
  • T1213.006 - Databases
  • T1027.004 - Compile After Delivery
  • T1597 - Search Closed Sources
  • T1009 - Binary Padding
  • T1027.014 - Polymorphic Code
  • T1601.001 - Patch System Image
  • T1546.013 - PowerShell Profile
  • T1056 - Input Capture
  • T1609 - Container Administration Command
  • T1197 - BITS Jobs
  • T1109 - Component Firmware
  • T1030 - Data Transfer Size Limits
MITREへのリンク →

APT29

Score: 0.64
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1027.004 - Compile After Delivery
  • T1556.008 - Network Provider DLL
  • T1099 - Timestomp
  • T1202 - Indirect Command Execution
  • T1015 - Accessibility Features
  • T1222.002 - Linux and Mac Permissions
  • T1177 - LSASS Driver
  • T1584.008 - Network Devices
  • T1592.004 - Client Configurations
MITREへのリンク →

Contagious Interview

Score: 0.62
Matched TTPs:
  • T1131 - Authentication Package
  • T1562.001 - Disable or Modify Tools
  • T1021.006 - Windows Remote Management
  • T1556 - Modify Authentication Process
  • T1027.004 - Compile After Delivery
  • T1597 - Search Closed Sources
  • T1601.001 - Patch System Image
  • T1546.013 - PowerShell Profile
  • T1056 - Input Capture
  • T1044 - File System Permissions Weakness
  • T1030 - Data Transfer Size Limits
  • T1547.005 - Security Support Provider
MITREへのリンク →

APT32

Score: 0.56
Matched TTPs:
  • T1131 - Authentication Package
  • T1562.001 - Disable or Modify Tools
  • T1556 - Modify Authentication Process
  • T1592.004 - Client Configurations
  • T1601.001 - Patch System Image
  • T1027.014 - Polymorphic Code
  • T1546.013 - PowerShell Profile
  • T1055.004 - Asynchronous Procedure Call
  • T1055.013 - Process Doppelgänging
  • T1113 - Screen Capture
  • T1547.005 - Security Support Provider
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る