Trusted Design

The Package That Never Shipped: Following a USPS Smishing Kit Through DNS Data

概要

A sophisticated smishing campaign impersonates United States Postal Service (USPS) package delivery notifications via SMS. The kit serves genuine USPS production HTML, CSS, fonts, and images verbatim, including live Google Analytics tags firing to USPS infrastructure. It captures victim card data in real-time through WebSocket connections, streaming keystrokes, performing server-side BIN lookups, and pushing routing decisions back to victim browsers. Starting from a single lure hostname, passive DNS analysis revealed 682 unique lookalike domains across seven Tencent Cloud hosts. A parallel UPS-themed campaign runs on the same infrastructure, with both variants sharing the internal theme name us_post_ups in cookies. The operation spans two distinct backends (GoFrame and Spring Boot) while maintaining identical real-time exfiltration mechanics and Caddy reverse proxy architecture.

Created: 2026-06-15

Indicators

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

HAFNIUM

Score: 11.84
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1134.002 - Create Process with Token
  • T1608.005 - Link Target
  • T1056 - Input Capture
  • T1591.004 - Identify Roles
MITREへのリンク →

menuPass

Score: 14.98
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1527 - Application Access Token
  • T1098.007 - Additional Local or Domain Groups
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Wizard Spider

Score: 22.06
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1183 - Image File Execution Options Injection
  • T1083 - File and Directory Discovery
  • T1597 - Search Closed Sources
  • T1056 - Input Capture
  • T1001.003 - Protocol or Service Impersonation
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

APT33

Score: 3.99
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Fox Kitten

Score: 13.48
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1177 - LSASS Driver
  • T1055.013 - Process Doppelgänging
  • T1656 - Impersonation
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Volt Typhoon

Score: 32.87
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1562.009 - Safe Mode Boot
  • T1686.003 - Windows Host Firewall
  • T1003.007 - Proc Filesystem
  • T1547.005 - Security Support Provider
  • T1134.002 - Create Process with Token
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1584.002 - DNS Server
  • T1591.004 - Identify Roles
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT1

Score: 13.90
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1587.003 - Digital Certificates
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Mustang Panda

Score: 33.07
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1546.011 - Application Shimming
  • T1183 - Image File Execution Options Injection
  • T1055.013 - Process Doppelgänging
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1169 - Sudo
  • T1136.003 - Cloud Account
  • T1056 - Input Capture
  • T1591.004 - Identify Roles
  • T1055.005 - Thread Local Storage
MITREへのリンク →

Play

Score: 11.55
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1597 - Search Closed Sources
  • T1574.009 - Path Interception by Unquoted Path
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Chimera

Score: 16.80
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1587.003 - Digital Certificates
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1056 - Input Capture
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
  • T1665 - Hide Infrastructure
MITREへのリンク →

Sea Turtle

Score: 6.40
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1587.003 - Digital Certificates
  • T1098.007 - Additional Local or Domain Groups
MITREへのリンク →

APT39

Score: 12.46
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1547.011 - Plist Modification
  • T1055.013 - Process Doppelgänging
  • T1001.003 - Protocol or Service Impersonation
  • T1027.004 - Compile After Delivery
MITREへのリンク →

RedCurl

Score: 15.08
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1587.003 - Digital Certificates
  • T1016.002 - Wi-Fi Discovery
  • T1090 - Proxy
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

APT5

Score: 6.87
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Agrius

Score: 6.94
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

GALLIUM

Score: 9.62
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

APT41

Score: 20.88
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1071.004 - DNS
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1574.009 - Path Interception by Unquoted Path
  • T1001.003 - Protocol or Service Impersonation
  • T1591.004 - Identify Roles
MITREへのリンク →

MuddyWater

Score: 18.91
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1506 - Web Session Cookie
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

APT28

Score: 28.22
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1222.002 - Linux and Mac Permissions
  • T1071.004 - DNS
  • T1098.007 - Additional Local or Domain Groups
  • T1547.011 - Plist Modification
  • T1608.005 - Link Target
  • T1574.009 - Path Interception by Unquoted Path
  • T1197 - BITS Jobs
  • T1591.004 - Identify Roles
  • T1585 - Establish Accounts
MITREへのリンク →

Turla

Score: 27.07
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1099 - Timestomp
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1218.001 - Compiled HTML File
  • T1056 - Input Capture
  • T1506 - Web Session Cookie
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

BRONZE BUTLER

Score: 13.05
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1003.007 - Proc Filesystem
  • T1592.004 - Client Configurations
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

UNC3886

Score: 17.00
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1021.006 - Windows Remote Management
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

Kimsuky

Score: 55.76
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1213.006 - Databases
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1134.002 - Create Process with Token
  • T1609 - Container Administration Command
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027.014 - Polymorphic Code
  • T1056 - Input Capture
  • T1506 - Web Session Cookie
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1656 - Impersonation
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
  • T1126 - Network Share Connection Removal
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT3

Score: 10.31
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

FIN8

Score: 9.06
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Ke3chang

Score: 19.56
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1003.007 - Proc Filesystem
  • T1055.013 - Process Doppelgänging
  • T1198 - SIP and Trust Provider Hijacking
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Lotus Blossom

Score: 6.07
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

FIN13

Score: 16.68
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1547.005 - Security Support Provider
  • T1055.004 - Asynchronous Procedure Call
  • T1134.001 - Token Impersonation/Theft
  • T1591.004 - Identify Roles
MITREへのリンク →

Earth Lusca

Score: 19.33
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1218.001 - Compiled HTML File
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Magic Hound

Score: 33.60
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1587.003 - Digital Certificates
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1547.005 - Security Support Provider
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1134.002 - Create Process with Token
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Aquatic Panda

Score: 10.63
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1003.007 - Proc Filesystem
  • T1597 - Search Closed Sources
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

INC Ransom

Score: 9.70
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

Akira

Score: 9.94
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1137.005 - Outlook Rules
  • T1597 - Search Closed Sources
  • T1056 - Input Capture
MITREへのリンク →

ToddyCat

Score: 13.37
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1056 - Input Capture
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT29

Score: 36.62
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1202 - Indirect Command Execution
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1592.004 - Client Configurations
  • T1568 - Dynamic Resolution
  • T1608.005 - Link Target
  • T1556.008 - Network Provider DLL
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Scattered Spider

Score: 30.87
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1609 - Container Administration Command
  • T1083 - File and Directory Discovery
  • T1556.008 - Network Provider DLL
  • T1597 - Search Closed Sources
  • T1056 - Input Capture
  • T1197 - BITS Jobs
MITREへのリンク →

FIN4

Score: 4.13
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
MITREへのリンク →

APT32

Score: 26.84
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1134.002 - Create Process with Token
  • T1055.013 - Process Doppelgänging
  • T1592.004 - Client Configurations
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Saint Bear

Score: 11.60
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1134.002 - Create Process with Token
  • T1055.013 - Process Doppelgänging
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

FIN6

Score: 8.93
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1055.013 - Process Doppelgänging
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Sidewinder

Score: 9.02
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1090 - Proxy
  • T1506 - Web Session Cookie
  • T1601.001 - Patch System Image
MITREへのリンク →

Winter Vivern

Score: 16.98
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1587.003 - Digital Certificates
  • T1098.007 - Additional Local or Domain Groups
  • T1055.013 - Process Doppelgänging
  • T1090 - Proxy
  • T1218.001 - Compiled HTML File
  • T1591.004 - Identify Roles
MITREへのリンク →

Silence

Score: 9.94
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
  • T1562.001 - Disable or Modify Tools
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Contagious Interview

Score: 33.50
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1021.006 - Windows Remote Management
  • T1183 - Image File Execution Options Injection
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
  • T1656 - Impersonation
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
  • T1126 - Network Share Connection Removal
MITREへのリンク →

LazyScripter

Score: 8.32
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

TA505

Score: 15.57
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1527 - Application Access Token
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

FIN7

Score: 17.41
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1055.013 - Process Doppelgänging
  • T1608.005 - Link Target
  • T1562.001 - Disable or Modify Tools
  • T1056 - Input Capture
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Cobalt Group

Score: 13.97
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1598.004 - Spearphishing Voice
  • T1027.014 - Polymorphic Code
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Higaisa

Score: 5.76
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1591.004 - Identify Roles
  • T1665 - Hide Infrastructure
MITREへのリンク →

Indrik Spider

Score: 11.55
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1003.007 - Proc Filesystem
  • T1183 - Image File Execution Options Injection
  • T1597 - Search Closed Sources
  • T1056 - Input Capture
  • T1591.004 - Identify Roles
MITREへのリンク →

Leafminer

Score: 8.37
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1101 - Security Support Provider
  • T1601.001 - Patch System Image
MITREへのリンク →

TA578

Score: 3.99
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
MITREへのリンク →

Evilnum

Score: 5.41
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1562.009 - Safe Mode Boot
MITREへのリンク →

Star Blizzard

Score: 12.15
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1609 - Container Administration Command
MITREへのリンク →

HEXANE

Score: 17.61
Matched TTPs:
  • T1099 - Timestomp
  • T1098.007 - Additional Local or Domain Groups
  • T1547.005 - Security Support Provider
  • T1183 - Image File Execution Options Injection
  • T1134.002 - Create Process with Token
  • T1055.004 - Asynchronous Procedure Call
  • T1056 - Input Capture
  • T1601.001 - Patch System Image
MITREへのリンク →

Gamaredon Group

Score: 30.30
Matched TTPs:
  • T1099 - Timestomp
  • T1527 - Application Access Token
  • T1562.009 - Safe Mode Boot
  • T1098.007 - Additional Local or Domain Groups
  • T1090 - Proxy
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1061 - Graphical User Interface
  • T1562.001 - Disable or Modify Tools
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

TA2541

Score: 9.97
Matched TTPs:
  • T1099 - Timestomp
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1506 - Web Session Cookie
MITREへのリンク →

Mustard Tempest

Score: 4.54
Matched TTPs:
  • T1682 - Query Public AI Services
MITREへのリンク →

Daggerfly

Score: 6.44
Matched TTPs:
  • T1584.008 - Network Devices
  • T1530 - Data from Cloud Storage
MITREへのリンク →

Dragonfly

Score: 16.22
Matched TTPs:
  • T1584.008 - Network Devices
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1055.013 - Process Doppelgänging
  • T1531 - Account Access Removal
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

Threat Group-3390

Score: 12.25
Matched TTPs:
  • T1584.008 - Network Devices
  • T1098.007 - Additional Local or Domain Groups
  • T1055.004 - Asynchronous Procedure Call
  • T1056 - Input Capture
  • T1574.009 - Path Interception by Unquoted Path
  • T1591.004 - Identify Roles
MITREへのリンク →

Ember Bear

Score: 12.24
Matched TTPs:
  • T1584.008 - Network Devices
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1056 - Input Capture
  • T1656 - Impersonation
MITREへのリンク →

Lazarus Group

Score: 35.66
Matched TTPs:
  • T1071.004 - DNS
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1547.011 - Plist Modification
  • T1134.002 - Create Process with Token
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1069.001 - Local Groups
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1591.004 - Identify Roles
  • T1055.005 - Thread Local Storage
  • T1665 - Hide Infrastructure
MITREへのリンク →

Storm-0501

Score: 19.17
Matched TTPs:
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1686.003 - Windows Host Firewall
  • T1027.014 - Polymorphic Code
  • T1056 - Input Capture
  • T1506 - Web Session Cookie
  • T1158 - Hidden Files and Directories
MITREへのリンク →

Sandworm Team

Score: 28.46
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1686.003 - Windows Host Firewall
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1183 - Image File Execution Options Injection
  • T1134.002 - Create Process with Token
  • T1055.004 - Asynchronous Procedure Call
  • T1562.001 - Disable or Modify Tools
  • T1075 - Pass the Hash
  • T1601.001 - Patch System Image
MITREへのリンク →

Leviathan

Score: 16.13
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1027.014 - Polymorphic Code
  • T1056 - Input Capture
  • T1001.003 - Protocol or Service Impersonation
MITREへのリンク →

Darkhotel

Score: 6.29
Matched TTPs:
  • T1562.009 - Safe Mode Boot
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
MITREへのリンク →

OilRig

Score: 19.39
Matched TTPs:
  • T1562.009 - Safe Mode Boot
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1055.013 - Process Doppelgänging
  • T1055.004 - Asynchronous Procedure Call
  • T1592.002 - Software
  • T1591.004 - Identify Roles
MITREへのリンク →

TeamTNT

Score: 15.60
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
  • T1665 - Hide Infrastructure
MITREへのリンク →

Poseidon Group

Score: 4.26
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

admin@338

Score: 5.21
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

PROMETHIUM

Score: 3.84
Matched TTPs:
  • T1530 - Data from Cloud Storage
MITREへのリンク →

Patchwork

Score: 14.83
Matched TTPs:
  • T1530 - Data from Cloud Storage
  • T1001.003 - Protocol or Service Impersonation
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
  • T1665 - Hide Infrastructure
MITREへのリンク →

Storm-1811

Score: 7.01
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1486 - Data Encrypted for Impact
  • T1591.004 - Identify Roles
MITREへのリンク →

APT42

Score: 5.70
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1506 - Web Session Cookie
MITREへのリンク →

IndigoZebra

Score: 3.53
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
MITREへのリンク →

ZIRCONIUM

Score: 12.28
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1608.005 - Link Target
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1591.004 - Identify Roles
MITREへのリンク →

RedEcho

Score: 3.92
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

EXOTIC LILY

Score: 6.33
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1134.002 - Create Process with Token
MITREへのリンク →

Silent Librarian

Score: 9.77
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1134.002 - Create Process with Token
  • T1609 - Container Administration Command
MITREへのリンク →

APT38

Score: 23.86
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1503 - Credentials from Web Browsers
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1590 - Gather Victim Network Information
  • T1597 - Search Closed Sources
  • T1506 - Web Session Cookie
  • T1493 - Transmitted Data Manipulation
  • T1591.004 - Identify Roles
MITREへのリンク →

Moonstone Sleet

Score: 13.61
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1134.002 - Create Process with Token
  • T1197 - BITS Jobs
  • T1126 - Network Share Connection Removal
MITREへのリンク →

CURIUM

Score: 7.43
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1218.001 - Compiled HTML File
MITREへのリンク →

LAPSUS$

Score: 12.74
Matched TTPs:
  • T1547.005 - Security Support Provider
  • T1134.002 - Create Process with Token
  • T1609 - Container Administration Command
  • T1556.008 - Network Provider DLL
MITREへのリンク →

Rocke

Score: 10.78
Matched TTPs:
  • T1009 - Binary Padding
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1506 - Web Session Cookie
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Medusa Group

Score: 15.17
Matched TTPs:
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1056 - Input Capture
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Velvet Ant

Score: 8.27
Matched TTPs:
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

BlackByte

Score: 11.12
Matched TTPs:
  • T1009 - Binary Padding
  • T1134.001 - Token Impersonation/Theft
  • T1597 - Search Closed Sources
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
MITREへのリンク →

FIN5

Score: 5.09
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1055.013 - Process Doppelgänging
MITREへのリンク →

Tonto Team

Score: 5.09
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1027.004 - Compile After Delivery
MITREへのリンク →

TA551

Score: 8.09
Matched TTPs:
  • T1134.002 - Create Process with Token
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Deep Panda

Score: 6.03
Matched TTPs:
  • T1177 - LSASS Driver
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Axiom

Score: 3.29
Matched TTPs:
  • T1177 - LSASS Driver
MITREへのリンク →

APT19

Score: 6.95
Matched TTPs:
  • T1055.013 - Process Doppelgänging
  • T1027.014 - Polymorphic Code
  • T1601.001 - Patch System Image
MITREへのリンク →

APT37

Score: 9.77
Matched TTPs:
  • T1055.013 - Process Doppelgänging
  • T1078 - Valid Accounts
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

Tropic Trooper

Score: 14.84
Matched TTPs:
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
  • T1136.003 - Cloud Account
  • T1506 - Web Session Cookie
  • T1591.004 - Identify Roles
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT12

Score: 4.54
Matched TTPs:
  • T1055.002 - Portable Executable Injection
MITREへのリンク →

APT17

Score: 5.45
Matched TTPs:
  • T1608.005 - Link Target
  • T1656 - Impersonation
MITREへのリンク →

Confucius

Score: 6.86
Matched TTPs:
  • T1608.005 - Link Target
  • T1056 - Input Capture
  • T1665 - Hide Infrastructure
MITREへのリンク →

POLONIUM

Score: 4.02
Matched TTPs:
  • T1608.005 - Link Target
  • T1056 - Input Capture
MITREへのリンク →

WIRTE

Score: 5.14
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
MITREへのリンク →

DarkVishnya

Score: 6.94
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1213.003 - Code Repositories
MITREへのリンク →

Windshift

Score: 6.03
Matched TTPs:
  • T1078 - Valid Accounts
  • T1506 - Web Session Cookie
MITREへのリンク →

DarkHydrus

Score: 4.13
Matched TTPs:
  • T1531 - Account Access Removal
MITREへのリンク →

Blue Mockingbird

Score: 3.70
Matched TTPs:
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
MITREへのリンク →

LuminousMoth

Score: 5.45
Matched TTPs:
  • T1056 - Input Capture
  • T1574.009 - Path Interception by Unquoted Path
MITREへのリンク →

Cinnamon Tempest

Score: 5.31
Matched TTPs:
  • T1056 - Input Capture
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

SideCopy

Score: 6.03
Matched TTPs:
  • T1584.002 - DNS Server
  • T1506 - Web Session Cookie
MITREへのリンク →

Machete

Score: 3.30
Matched TTPs:
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.70
Matched TTPs:
  • T1056 - Input Capture
  • T1009 - Binary Padding
  • T1134.002 - Create Process with Token
  • T1609 - Container Administration Command
  • T1546.013 - PowerShell Profile
  • T1656 - Impersonation
  • T1506 - Web Session Cookie
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
  • T1183 - Image File Execution Options Injection
  • T1601.001 - Patch System Image
  • T1546.011 - Application Shimming
  • T1560.001 - Archive via Utility
  • T1027.004 - Compile After Delivery
  • T1608.005 - Link Target
  • T1197 - BITS Jobs
  • T1098.007 - Additional Local or Domain Groups
  • T1126 - Network Share Connection Removal
  • T1003.007 - Proc Filesystem
  • T1213.006 - Databases
  • T1597 - Search Closed Sources
  • T1665 - Hide Infrastructure
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る