Trusted Design

Agentic AI Uncovers New China-Linked Cluster OP-512

概要

A newly identified China-linked espionage cluster designated OP-512 has been discovered targeting Internet Information Services (IIS) servers through advanced AI-driven detection. The operation involves deploying a sophisticated custom web shell framework consisting of three components: a file manager with command-and-control notification channel and two cryptographically authenticated command handlers. Each deployment is cryptographically unique, utilizing RSA and RC4 encryption alongside timestomping techniques to evade signature-based detection. The attacker maintained persistence for 75 days before rapid deployment of multiple access paths, privilege escalation tools including BadPotato, SweetPotato, and EfsPotato, and establishment of dual notification channels through DNS and HTTP. The framework employs hex-encoded subdomain queries for self-reporting and automated builder-generated code with randomized variables. This represents the fourth China-linked cluster documented targeting legacy IIS infrast...

Created: 2026-07-05

Indicators

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

APT28

Score: 29.67
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1024 - Custom Cryptographic Protocol
  • T1139 - Bash History
  • T1555.003 - Credentials from Web Browsers
  • T1547.011 - Plist Modification
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1574.009 - Path Interception by Unquoted Path
  • T1197 - BITS Jobs
  • T1055.008 - Ptrace System Calls
MITREへのリンク →

APT29

Score: 40.67
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1202 - Indirect Command Execution
  • T1024 - Custom Cryptographic Protocol
  • T1555.003 - Credentials from Web Browsers
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1608.005 - Link Target
  • T1556.008 - Network Provider DLL
  • T1497.002 - User Activity Based Checks
  • T1027.004 - Compile After Delivery
  • T1223 - Compiled HTML File
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Contagious Interview

Score: 24.57
Matched TTPs:
  • T1044 - File System Permissions Weakness
  • T1546.013 - PowerShell Profile
  • T1547.005 - Security Support Provider
  • T1608.005 - Link Target
  • T1087.004 - Cloud Account
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027.004 - Compile After Delivery
  • T1601.001 - Patch System Image
  • T1556 - Modify Authentication Process
MITREへのリンク →

Scattered Spider

Score: 45.14
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
  • T1109 - Component Firmware
  • T1560.003 - Archive via Custom Method
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1547.005 - Security Support Provider
  • T1609 - Container Administration Command
  • T1083 - File and Directory Discovery
  • T1051 - Shared Webroot
  • T1087.004 - Cloud Account
  • T1556.008 - Network Provider DLL
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1197 - BITS Jobs
  • T1564.003 - Hidden Window
MITREへのリンク →

FIN4

Score: 4.13
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
MITREへのリンク →

Turla

Score: 23.39
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1099 - Timestomp
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1601.001 - Patch System Image
  • T1569.002 - Service Execution
  • T1490 - Inhibit System Recovery
MITREへのリンク →

APT32

Score: 25.61
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.005 - Security Support Provider
  • T1555.003 - Credentials from Web Browsers
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
  • T1601.001 - Patch System Image
  • T1556 - Modify Authentication Process
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Saint Bear

Score: 6.58
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
MITREへのリンク →

FIN6

Score: 11.85
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1562 - Impair Defenses
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1601.001 - Patch System Image
  • T1556 - Modify Authentication Process
MITREへのリンク →

Sidewinder

Score: 7.92
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1090 - Proxy
  • T1497.002 - User Activity Based Checks
  • T1601.001 - Patch System Image
MITREへのリンク →

MuddyWater

Score: 26.56
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1562 - Impair Defenses
  • T1518.002 - Backup Software Discovery
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1608.005 - Link Target
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1601.001 - Patch System Image
MITREへのリンク →

Earth Lusca

Score: 15.23
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1003.007 - Proc Filesystem
  • T1110.003 - Password Spraying
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1027.004 - Compile After Delivery
MITREへのリンク →

TA577

Score: 4.64
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1024 - Custom Cryptographic Protocol
MITREへのリンク →

Winter Vivern

Score: 11.32
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1587.003 - Digital Certificates
  • T1090 - Proxy
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

Silence

Score: 13.22
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
  • T1497.002 - User Activity Based Checks
  • T1048 - Exfiltration Over Alternative Protocol
  • T1562.001 - Disable or Modify Tools
  • T1601.001 - Patch System Image
MITREへのリンク →

LazyScripter

Score: 6.65
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1601.001 - Patch System Image
MITREへのリンク →

TA505

Score: 22.05
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1560.003 - Archive via Custom Method
  • T1527 - Application Access Token
  • T1016.002 - Wi-Fi Discovery
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1601.001 - Patch System Image
MITREへのリンク →

FIN7

Score: 19.32
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1009 - Binary Padding
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1573 - Encrypted Channel
  • T1601.001 - Patch System Image
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Cobalt Group

Score: 18.98
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1518.002 - Backup Software Discovery
  • T1598.004 - Spearphishing Voice
  • T1497.002 - User Activity Based Checks
  • T1027.014 - Polymorphic Code
  • T1573 - Encrypted Channel
  • T1601.001 - Patch System Image
MITREへのリンク →

Higaisa

Score: 9.71
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1087.004 - Cloud Account
  • T1665 - Hide Infrastructure
  • T1569.002 - Service Execution
MITREへのリンク →

Kimsuky

Score: 62.38
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1109 - Component Firmware
  • T1213.006 - Databases
  • T1003.007 - Proc Filesystem
  • T1024 - Custom Cryptographic Protocol
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1555.003 - Credentials from Web Browsers
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
  • T1051 - Shared Webroot
  • T1608.005 - Link Target
  • T1654 - Log Enumeration
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027.014 - Polymorphic Code
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1601.001 - Patch System Image
  • T1665 - Hide Infrastructure
  • T1008 - Fallback Channels
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Indrik Spider

Score: 15.58
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1003.007 - Proc Filesystem
  • T1574.008 - Path Interception by Search Order Hijacking
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Leafminer

Score: 9.03
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1562 - Impair Defenses
  • T1051 - Shared Webroot
  • T1601.001 - Patch System Image
MITREへのリンク →

Mustang Panda

Score: 27.78
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1024 - Custom Cryptographic Protocol
  • T1546.011 - Application Shimming
  • T1555.003 - Credentials from Web Browsers
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1136.003 - Cloud Account
  • T1055.005 - Thread Local Storage
  • T1556 - Modify Authentication Process
MITREへのリンク →

TA578

Score: 3.99
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
MITREへのリンク →

Evilnum

Score: 7.67
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1109 - Component Firmware
  • T1562 - Impair Defenses
MITREへのリンク →

Star Blizzard

Score: 14.04
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1109 - Component Firmware
  • T1024 - Custom Cryptographic Protocol
  • T1547.005 - Security Support Provider
  • T1609 - Container Administration Command
MITREへのリンク →

LuminousMoth

Score: 8.45
Matched TTPs:
  • T1109 - Component Firmware
  • T1087.004 - Cloud Account
  • T1574.009 - Path Interception by Unquoted Path
MITREへのリンク →

Sandworm Team

Score: 37.90
Matched TTPs:
  • T1109 - Component Firmware
  • T1484.002 - Trust Modification
  • T1686.003 - Windows Host Firewall
  • T1016.002 - Wi-Fi Discovery
  • T1555.003 - Credentials from Web Browsers
  • T1546.008 - Accessibility Features
  • T1055.004 - Asynchronous Procedure Call
  • T1049 - System Network Connections Discovery
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1573 - Encrypted Channel
  • T1601.001 - Patch System Image
MITREへのリンク →

Lotus Blossom

Score: 10.44
Matched TTPs:
  • T1109 - Component Firmware
  • T1099 - Timestomp
  • T1055.004 - Asynchronous Procedure Call
  • T1569.002 - Service Execution
MITREへのリンク →

APT42

Score: 3.83
Matched TTPs:
  • T1109 - Component Firmware
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

Magic Hound

Score: 32.30
Matched TTPs:
  • T1099 - Timestomp
  • T1587.003 - Digital Certificates
  • T1024 - Custom Cryptographic Protocol
  • T1016.002 - Wi-Fi Discovery
  • T1547.005 - Security Support Provider
  • T1009 - Binary Padding
  • T1555.003 - Credentials from Web Browsers
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1601.001 - Patch System Image
MITREへのリンク →

HEXANE

Score: 19.25
Matched TTPs:
  • T1099 - Timestomp
  • T1024 - Custom Cryptographic Protocol
  • T1562 - Impair Defenses
  • T1070.006 - Timestomp
  • T1547.005 - Security Support Provider
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1601.001 - Patch System Image
MITREへのリンク →

Gamaredon Group

Score: 24.85
Matched TTPs:
  • T1099 - Timestomp
  • T1527 - Application Access Token
  • T1090 - Proxy
  • T1608.005 - Link Target
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1554 - Compromise Host Software Binary
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1601.001 - Patch System Image
MITREへのリンク →

TA2541

Score: 7.36
Matched TTPs:
  • T1099 - Timestomp
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
MITREへのリンク →

FIN13

Score: 25.44
Matched TTPs:
  • T1099 - Timestomp
  • T1560.003 - Archive via Custom Method
  • T1584.008 - Network Devices
  • T1547.005 - Security Support Provider
  • T1555.003 - Credentials from Web Browsers
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1134.001 - Token Impersonation/Theft
  • T1497.002 - User Activity Based Checks
  • T1569.002 - Service Execution
MITREへのリンク →

HAFNIUM

Score: 17.74
Matched TTPs:
  • T1099 - Timestomp
  • T1555.003 - Credentials from Web Browsers
  • T1049 - System Network Connections Discovery
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1055.008 - Ptrace System Calls
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Volt Typhoon

Score: 43.28
Matched TTPs:
  • T1099 - Timestomp
  • T1560.003 - Archive via Custom Method
  • T1686.003 - Windows Host Firewall
  • T1003.007 - Proc Filesystem
  • T1556.002 - Password Filter DLL
  • T1562 - Impair Defenses
  • T1070.006 - Timestomp
  • T1547.005 - Security Support Provider
  • T1555.003 - Credentials from Web Browsers
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1049 - System Network Connections Discovery
  • T1497.002 - User Activity Based Checks
  • T1665 - Hide Infrastructure
  • T1569.002 - Service Execution
MITREへのリンク →

FIN8

Score: 10.50
Matched TTPs:
  • T1099 - Timestomp
  • T1497.002 - User Activity Based Checks
  • T1027 - Obfuscated Files or Information
  • T1601.001 - Patch System Image
  • T1556 - Modify Authentication Process
MITREへのリンク →

Mustard Tempest

Score: 4.54
Matched TTPs:
  • T1682 - Query Public AI Services
MITREへのリンク →

APT41

Score: 37.26
Matched TTPs:
  • T1560.003 - Archive via Custom Method
  • T1584.008 - Network Devices
  • T1562 - Impair Defenses
  • T1574.008 - Path Interception by Search Order Hijacking
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1048 - Exfiltration Over Alternative Protocol
  • T1027 - Obfuscated Files or Information
  • T1573 - Encrypted Channel
  • T1574.009 - Path Interception by Unquoted Path
  • T1564.003 - Hidden Window
  • T1008 - Fallback Channels
MITREへのリンク →

APT3

Score: 16.35
Matched TTPs:
  • T1560.003 - Archive via Custom Method
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

Daggerfly

Score: 6.32
Matched TTPs:
  • T1584.008 - Network Devices
  • T1497.002 - User Activity Based Checks
  • T1573 - Encrypted Channel
MITREへのリンク →

GALLIUM

Score: 11.61
Matched TTPs:
  • T1584.008 - Network Devices
  • T1555.003 - Credentials from Web Browsers
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

Dragonfly

Score: 21.03
Matched TTPs:
  • T1584.008 - Network Devices
  • T1009 - Binary Padding
  • T1555.003 - Credentials from Web Browsers
  • T1654 - Log Enumeration
  • T1497.002 - User Activity Based Checks
  • T1531 - Account Access Removal
  • T1573 - Encrypted Channel
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Ke3chang

Score: 16.65
Matched TTPs:
  • T1584.008 - Network Devices
  • T1003.007 - Proc Filesystem
  • T1198 - SIP and Trust Provider Hijacking
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
  • T1087.004 - Cloud Account
MITREへのリンク →

Agrius

Score: 8.13
Matched TTPs:
  • T1584.008 - Network Devices
  • T1555.003 - Credentials from Web Browsers
  • T1087.004 - Cloud Account
  • T1597 - Search Closed Sources
MITREへのリンク →

APT5

Score: 6.89
Matched TTPs:
  • T1584.008 - Network Devices
  • T1555.003 - Credentials from Web Browsers
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

menuPass

Score: 11.72
Matched TTPs:
  • T1584.008 - Network Devices
  • T1527 - Application Access Token
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

Threat Group-3390

Score: 17.39
Matched TTPs:
  • T1584.008 - Network Devices
  • T1218.003 - CMSTP
  • T1555.003 - Credentials from Web Browsers
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1573 - Encrypted Channel
  • T1574.009 - Path Interception by Unquoted Path
MITREへのリンク →

Wizard Spider

Score: 15.39
Matched TTPs:
  • T1584.008 - Network Devices
  • T1083 - File and Directory Discovery
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1601.001 - Patch System Image
  • T1556 - Modify Authentication Process
MITREへのリンク →

Ember Bear

Score: 11.88
Matched TTPs:
  • T1584.008 - Network Devices
  • T1555.003 - Credentials from Web Browsers
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

RedCurl

Score: 15.86
Matched TTPs:
  • T1587.003 - Digital Certificates
  • T1016.002 - Wi-Fi Discovery
  • T1090 - Proxy
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Sea Turtle

Score: 7.72
Matched TTPs:
  • T1587.003 - Digital Certificates
  • T1555.003 - Credentials from Web Browsers
  • T1490 - Inhibit System Recovery
MITREへのリンク →

APT1

Score: 7.54
Matched TTPs:
  • T1587.003 - Digital Certificates
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Chimera

Score: 19.55
Matched TTPs:
  • T1587.003 - Digital Certificates
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1574 - Hijack Execution Flow
  • T1601.001 - Patch System Image
  • T1665 - Hide Infrastructure
MITREへのリンク →

Storm-0501

Score: 17.49
Matched TTPs:
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1686.003 - Windows Host Firewall
  • T1574.008 - Path Interception by Search Order Hijacking
  • T1497.002 - User Activity Based Checks
  • T1027 - Obfuscated Files or Information
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Leviathan

Score: 18.22
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1024 - Custom Cryptographic Protocol
  • T1555.003 - Credentials from Web Browsers
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1554 - Compromise Host Software Binary
  • T1027.014 - Polymorphic Code
MITREへのリンク →

BRONZE BUTLER

Score: 10.75
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1008 - Fallback Channels
MITREへのリンク →

TeamTNT

Score: 18.40
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1009 - Binary Padding
  • T1110.003 - Password Spraying
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1665 - Hide Infrastructure
MITREへのリンク →

OilRig

Score: 23.20
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1024 - Custom Cryptographic Protocol
  • T1562 - Impair Defenses
  • T1009 - Binary Padding
  • T1555.003 - Credentials from Web Browsers
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1048 - Exfiltration Over Alternative Protocol
  • T1556 - Modify Authentication Process
MITREへのリンク →

Aquatic Panda

Score: 6.98
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1601.001 - Patch System Image
MITREへのリンク →

Poseidon Group

Score: 5.06
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

admin@338

Score: 4.26
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

UNC3886

Score: 15.26
Matched TTPs:
  • T1556.002 - Password Filter DLL
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
MITREへのリンク →

LAPSUS$

Score: 21.26
Matched TTPs:
  • T1024 - Custom Cryptographic Protocol
  • T1547.005 - Security Support Provider
  • T1020 - Automated Exfiltration
  • T1609 - Container Administration Command
  • T1556.008 - Network Provider DLL
  • T1564.003 - Hidden Window
MITREへのリンク →

IndigoZebra

Score: 4.68
Matched TTPs:
  • T1024 - Custom Cryptographic Protocol
  • T1608.005 - Link Target
MITREへのリンク →

Akira

Score: 9.48
Matched TTPs:
  • T1137.005 - Outlook Rules
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Stealth Falcon

Score: 5.44
Matched TTPs:
  • T1562 - Impair Defenses
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

APT39

Score: 15.22
Matched TTPs:
  • T1562 - Impair Defenses
  • T1555.003 - Credentials from Web Browsers
  • T1547.011 - Plist Modification
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1027.004 - Compile After Delivery
  • T1569.002 - Service Execution
MITREへのリンク →

APT33

Score: 11.13
Matched TTPs:
  • T1562 - Impair Defenses
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
  • T1556 - Modify Authentication Process
MITREへのリンク →

Lazarus Group

Score: 36.83
Matched TTPs:
  • T1070.006 - Timestomp
  • T1009 - Binary Padding
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1069.001 - Local Groups
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1055.005 - Thread Local Storage
  • T1665 - Hide Infrastructure
  • T1569.002 - Service Execution
  • T1556 - Modify Authentication Process
MITREへのリンク →

Medusa Group

Score: 17.05
Matched TTPs:
  • T1218.003 - CMSTP
  • T1009 - Binary Padding
  • T1555.003 - Credentials from Web Browsers
  • T1608.005 - Link Target
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1601.001 - Patch System Image
MITREへのリンク →

Salt Typhoon

Score: 8.93
Matched TTPs:
  • T1009 - Binary Padding
  • T1110.003 - Password Spraying
  • T1556 - Modify Authentication Process
MITREへのリンク →

Rocke

Score: 12.16
Matched TTPs:
  • T1009 - Binary Padding
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027.004 - Compile After Delivery
  • T1008 - Fallback Channels
MITREへのリンク →

Moses Staff

Score: 4.11
Matched TTPs:
  • T1009 - Binary Padding
  • T1555.003 - Credentials from Web Browsers
MITREへのリンク →

ToddyCat

Score: 7.71
Matched TTPs:
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT38

Score: 18.76
Matched TTPs:
  • T1009 - Binary Padding
  • T1555.003 - Credentials from Web Browsers
  • T1055.004 - Asynchronous Procedure Call
  • T1497.002 - User Activity Based Checks
  • T1590 - Gather Victim Network Information
  • T1048 - Exfiltration Over Alternative Protocol
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

Velvet Ant

Score: 13.87
Matched TTPs:
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1569.002 - Service Execution
  • T1490 - Inhibit System Recovery
MITREへのリンク →

BlackByte

Score: 15.15
Matched TTPs:
  • T1009 - Binary Padding
  • T1555.003 - Credentials from Web Browsers
  • T1134.001 - Token Impersonation/Theft
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

CURIUM

Score: 4.54
Matched TTPs:
  • T1555.003 - Credentials from Web Browsers
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
MITREへのリンク →

BackdoorDiplomacy

Score: 3.50
Matched TTPs:
  • T1555.003 - Credentials from Web Browsers
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Deep Panda

Score: 8.60
Matched TTPs:
  • T1555.003 - Credentials from Web Browsers
  • T1177 - LSASS Driver
  • T1497.002 - User Activity Based Checks
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Tropic Trooper

Score: 16.42
Matched TTPs:
  • T1555.003 - Credentials from Web Browsers
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
  • T1136.003 - Cloud Account
  • T1665 - Hide Infrastructure
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Fox Kitten

Score: 10.24
Matched TTPs:
  • T1555.003 - Credentials from Web Browsers
  • T1177 - LSASS Driver
  • T1051 - Shared Webroot
  • T1497.002 - User Activity Based Checks
  • T1601.001 - Patch System Image
MITREへのリンク →

Tonto Team

Score: 7.65
Matched TTPs:
  • T1555.003 - Credentials from Web Browsers
  • T1547.011 - Plist Modification
  • T1497.002 - User Activity Based Checks
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Cinnamon Tempest

Score: 6.76
Matched TTPs:
  • T1574.008 - Path Interception by Search Order Hijacking
  • T1497.002 - User Activity Based Checks
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Axiom

Score: 6.91
Matched TTPs:
  • T1177 - LSASS Driver
  • T1049 - System Network Connections Discovery
MITREへのリンク →

Silent Librarian

Score: 7.28
Matched TTPs:
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
MITREへのリンク →

INC Ransom

Score: 9.49
Matched TTPs:
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

ZIRCONIUM

Score: 9.77
Matched TTPs:
  • T1608.005 - Link Target
  • T1087.004 - Cloud Account
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
MITREへのリンク →

Confucius

Score: 7.62
Matched TTPs:
  • T1608.005 - Link Target
  • T1087.004 - Cloud Account
  • T1497.002 - User Activity Based Checks
  • T1665 - Hide Infrastructure
MITREへのリンク →

WIRTE

Score: 5.94
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Blue Mockingbird

Score: 3.55
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1027.014 - Polymorphic Code
MITREへのリンク →

APT19

Score: 5.41
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1027.014 - Polymorphic Code
  • T1601.001 - Patch System Image
MITREへのリンク →

Thrip

Score: 3.55
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1556 - Modify Authentication Process
MITREへのリンク →

Storm-1811

Score: 7.68
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1027 - Obfuscated Files or Information
  • T1486 - Data Encrypted for Impact
MITREへのリンク →

Play

Score: 10.57
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1597 - Search Closed Sources
  • T1574.009 - Path Interception by Unquoted Path
  • T1601.001 - Patch System Image
  • T1490 - Inhibit System Recovery
MITREへのリンク →

Inception

Score: 3.55
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1027.014 - Polymorphic Code
MITREへのリンク →

FIN10

Score: 3.47
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1490 - Inhibit System Recovery
MITREへのリンク →

DarkVishnya

Score: 3.20
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Patchwork

Score: 8.78
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1601.001 - Patch System Image
  • T1665 - Hide Infrastructure
  • T1008 - Fallback Channels
MITREへのリンク →

DarkHydrus

Score: 4.93
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1531 - Account Access Removal
MITREへのリンク →

GOLD SOUTHFIELD

Score: 5.59
Matched TTPs:
  • T1497.002 - User Activity Based Checks
  • T1573 - Encrypted Channel
  • T1601.001 - Patch System Image
MITREへのリンク →

Dark Caracal

Score: 3.44
Matched TTPs:
  • T1048 - Exfiltration Over Alternative Protocol
MITREへのリンク →

Moonstone Sleet

Score: 8.71
Matched TTPs:
  • T1027 - Obfuscated Files or Information
  • T1573 - Encrypted Channel
  • T1197 - BITS Jobs
MITREへのリンク →

TA551

Score: 4.61
Matched TTPs:
  • T1027.014 - Polymorphic Code
  • T1601.001 - Patch System Image
MITREへのリンク →

RTM

Score: 3.29
Matched TTPs:
  • T1008 - Fallback Channels
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.70
Matched TTPs:
  • T1008 - Fallback Channels
  • T1024 - Custom Cryptographic Protocol
  • T1009 - Binary Padding
  • T1197 - BITS Jobs
  • T1665 - Hide Infrastructure
  • T1546.011 - Application Shimming
  • T1027.004 - Compile After Delivery
  • T1546.008 - Accessibility Features
  • T1497.002 - User Activity Based Checks
  • T1003.007 - Proc Filesystem
  • T1597 - Search Closed Sources
  • T1555.003 - Credentials from Web Browsers
  • T1601.001 - Patch System Image
  • T1608.005 - Link Target
  • T1051 - Shared Webroot
  • T1027.014 - Polymorphic Code
  • T1087.004 - Cloud Account
  • T1654 - Log Enumeration
  • T1546.013 - PowerShell Profile
  • T1490 - Inhibit System Recovery
  • T1109 - Component Firmware
  • T1609 - Container Administration Command
  • T1213.006 - Databases
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る