Trusted Design

Detecting the Klue supply chain attack in Salesforce instances

概要

On June 11, 2026, the Icarus threat group compromised Klue's backend systems, a market intelligence platform used by hundreds of enterprises to sync competitive battlecard data with CRM environments. The attackers exploited a dormant credential from an abandoned prototype integration to harvest OAuth tokens for Salesforce and Gong. Through automated API calls using Python scripts, the group exfiltrated CRM data including business contacts, price quotes, and sales communications from multiple customer Salesforce organizations. Klue detected the anomalous activity on June 12 and revoked OAuth credentials on June 13. The attackers subsequently launched an extortion campaign starting June 16, demanding victims contact them via Session Messenger within 48 hours.

Created: 2026-06-23

Indicators

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

HAFNIUM

Score: 9.43
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1591.004 - Identify Roles
  • T1055.008 - Ptrace System Calls
MITREへのリンク →

menuPass

Score: 15.86
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1527 - Application Access Token
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Wizard Spider

Score: 11.96
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1598.003 - Spearphishing Link
  • T1183 - Image File Execution Options Injection
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

APT33

Score: 4.87
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1598.003 - Spearphishing Link
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Fox Kitten

Score: 7.70
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1177 - LSASS Driver
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Volt Typhoon

Score: 33.45
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1562.009 - Safe Mode Boot
  • T1686.003 - Windows Host Firewall
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1102 - Web Service
  • T1584.002 - DNS Server
  • T1065 - Uncommonly Used Port
  • T1591.004 - Identify Roles
  • T1665 - Hide Infrastructure
  • T1578.001 - Create Snapshot
MITREへのリンク →

APT1

Score: 11.48
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1598.003 - Spearphishing Link
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Mustang Panda

Score: 29.05
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1546.011 - Application Shimming
  • T1183 - Image File Execution Options Injection
  • T1055.004 - Asynchronous Procedure Call
  • T1102 - Web Service
  • T1169 - Sudo
  • T1136.003 - Cloud Account
  • T1591.004 - Identify Roles
  • T1055.005 - Thread Local Storage
MITREへのリンク →

Play

Score: 6.21
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Chimera

Score: 18.63
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1574 - Hijack Execution Flow
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
  • T1665 - Hide Infrastructure
  • T1578.001 - Create Snapshot
MITREへのリンク →

Sea Turtle

Score: 6.73
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1063 - Security Software Discovery
  • T1098.007 - Additional Local or Domain Groups
MITREへのリンク →

APT39

Score: 7.55
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1598.003 - Spearphishing Link
  • T1547.011 - Plist Modification
  • T1027.004 - Compile After Delivery
MITREへのリンク →

RedCurl

Score: 12.67
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1598.003 - Spearphishing Link
  • T1016.002 - Wi-Fi Discovery
  • T1090 - Proxy
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

APT5

Score: 10.31
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1055.004 - Asynchronous Procedure Call
  • T1102 - Web Service
  • T1591.004 - Identify Roles
MITREへのリンク →

Agrius

Score: 6.94
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

GALLIUM

Score: 9.62
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

APT41

Score: 20.25
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1598.003 - Spearphishing Link
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1027 - Obfuscated Files or Information
  • T1030 - Data Transfer Size Limits
  • T1564.003 - Hidden Window
  • T1591.004 - Identify Roles
MITREへのリンク →

MuddyWater

Score: 18.04
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1598.003 - Spearphishing Link
  • T1518.002 - Backup Software Discovery
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

APT28

Score: 19.39
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1222.002 - Linux and Mac Permissions
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1547.011 - Plist Modification
  • T1197 - BITS Jobs
  • T1591.004 - Identify Roles
  • T1055.008 - Ptrace System Calls
MITREへのリンク →

Turla

Score: 21.77
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1063 - Security Software Discovery
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
  • T1578.001 - Create Snapshot
MITREへのリンク →

BRONZE BUTLER

Score: 20.36
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1598.003 - Spearphishing Link
  • T1003.007 - Proc Filesystem
  • T1592.004 - Client Configurations
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

UNC3886

Score: 24.13
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1689 - Downgrade Attack
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1021.006 - Windows Remote Management
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

Kimsuky

Score: 45.81
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1213.006 - Databases
  • T1598.003 - Spearphishing Link
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
  • T1597 - Search Closed Sources
  • T1027.014 - Polymorphic Code
  • T1030 - Data Transfer Size Limits
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT3

Score: 10.31
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

FIN8

Score: 10.37
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1598.003 - Spearphishing Link
  • T1027 - Obfuscated Files or Information
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Ke3chang

Score: 17.22
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1003.007 - Proc Filesystem
  • T1198 - SIP and Trust Provider Hijacking
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Lotus Blossom

Score: 6.07
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

FIN13

Score: 13.75
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1055.004 - Asynchronous Procedure Call
  • T1134.001 - Token Impersonation/Theft
  • T1591.004 - Identify Roles
MITREへのリンク →

Earth Lusca

Score: 9.71
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1055.004 - Asynchronous Procedure Call
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Magic Hound

Score: 25.19
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Aquatic Panda

Score: 12.17
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1003.007 - Proc Filesystem
  • T1102 - Web Service
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

INC Ransom

Score: 8.42
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1591.004 - Identify Roles
MITREへのリンク →

Akira

Score: 10.27
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1137.005 - Outlook Rules
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
MITREへのリンク →

ToddyCat

Score: 9.46
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
  • T1665 - Hide Infrastructure
MITREへのリンク →

APT29

Score: 30.94
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1598.003 - Spearphishing Link
  • T1202 - Indirect Command Execution
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1592.004 - Client Configurations
  • T1556.008 - Network Provider DLL
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Scattered Spider

Score: 31.23
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
  • T1098.007 - Additional Local or Domain Groups
  • T1609 - Container Administration Command
  • T1556.008 - Network Provider DLL
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1030 - Data Transfer Size Limits
  • T1197 - BITS Jobs
  • T1564.003 - Hidden Window
  • T1022 - Data Encrypted
MITREへのリンク →

FIN4

Score: 5.01
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
  • T1598.003 - Spearphishing Link
MITREへのリンク →

HEXANE

Score: 13.77
Matched TTPs:
  • T1099 - Timestomp
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1055.004 - Asynchronous Procedure Call
  • T1065 - Uncommonly Used Port
  • T1601.001 - Patch System Image
MITREへのリンク →

Gamaredon Group

Score: 26.85
Matched TTPs:
  • T1099 - Timestomp
  • T1527 - Application Access Token
  • T1562.009 - Safe Mode Boot
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1090 - Proxy
  • T1554 - Compromise Host Software Binary
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

TA2541

Score: 6.94
Matched TTPs:
  • T1099 - Timestomp
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1597 - Search Closed Sources
MITREへのリンク →

Mustard Tempest

Score: 4.54
Matched TTPs:
  • T1682 - Query Public AI Services
MITREへのリンク →

Dragonfly

Score: 10.62
Matched TTPs:
  • T1584.008 - Network Devices
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

Threat Group-3390

Score: 20.19
Matched TTPs:
  • T1584.008 - Network Devices
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1218.003 - CMSTP
  • T1055.004 - Asynchronous Procedure Call
  • T1678 - Delay Execution
  • T1591.004 - Identify Roles
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

Ember Bear

Score: 10.23
Matched TTPs:
  • T1584.008 - Network Devices
  • T1102 - Web Service
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Sandworm Team

Score: 36.62
Matched TTPs:
  • T1063 - Security Software Discovery
  • T1484.002 - Trust Modification
  • T1686.003 - Windows Host Firewall
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1055.004 - Asynchronous Procedure Call
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1075 - Pass the Hash
  • T1601.001 - Patch System Image
MITREへのリンク →

FIN6

Score: 9.11
Matched TTPs:
  • T1063 - Security Software Discovery
  • T1598.003 - Spearphishing Link
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Leviathan

Score: 15.69
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1554 - Compromise Host Software Binary
  • T1027.014 - Polymorphic Code
MITREへのリンク →

TA505

Score: 16.81
Matched TTPs:
  • T1527 - Application Access Token
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1016.002 - Wi-Fi Discovery
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Evilnum

Score: 3.44
Matched TTPs:
  • T1562.009 - Safe Mode Boot
MITREへのリンク →

Darkhotel

Score: 7.86
Matched TTPs:
  • T1562.009 - Safe Mode Boot
  • T1598.003 - Spearphishing Link
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

OilRig

Score: 13.38
Matched TTPs:
  • T1562.009 - Safe Mode Boot
  • T1598.003 - Spearphishing Link
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Storm-0501

Score: 13.47
Matched TTPs:
  • T1686.003 - Windows Host Firewall
  • T1027 - Obfuscated Files or Information
  • T1027.014 - Polymorphic Code
  • T1158 - Hidden Files and Directories
MITREへのリンク →

Cobalt Group

Score: 15.11
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1518.002 - Backup Software Discovery
  • T1598.004 - Spearphishing Voice
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Lazarus Group

Score: 30.75
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1547.011 - Plist Modification
  • T1055.004 - Asynchronous Procedure Call
  • T1069.001 - Local Groups
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1591.004 - Identify Roles
  • T1055.005 - Thread Local Storage
  • T1665 - Hide Infrastructure
  • T1578.001 - Create Snapshot
MITREへのリンク →

Saint Bear

Score: 6.66
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1597 - Search Closed Sources
  • T1030 - Data Transfer Size Limits
  • T1591.004 - Identify Roles
MITREへのリンク →

Tropic Trooper

Score: 13.81
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
  • T1136.003 - Cloud Account
  • T1591.004 - Identify Roles
  • T1665 - Hide Infrastructure
MITREへのリンク →

admin@338

Score: 6.09
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

WIRTE

Score: 6.02
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
MITREへのリンク →

APT32

Score: 15.93
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1592.004 - Client Configurations
  • T1055.004 - Asynchronous Procedure Call
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Inception

Score: 3.62
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1027.014 - Polymorphic Code
MITREへのリンク →

EXOTIC LILY

Score: 4.68
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
MITREへのリンク →

Patchwork

Score: 6.53
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
  • T1665 - Hide Infrastructure
MITREへのリンク →

TA551

Score: 6.44
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Winter Vivern

Score: 6.63
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1090 - Proxy
  • T1591.004 - Identify Roles
MITREへのリンク →

Higaisa

Score: 7.25
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1591.004 - Identify Roles
  • T1665 - Hide Infrastructure
  • T1578.001 - Create Snapshot
MITREへのリンク →

Confucius

Score: 3.71
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1665 - Hide Infrastructure
MITREへのリンク →

Gorgon Group

Score: 3.63
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

APT19

Score: 5.48
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1027.014 - Polymorphic Code
  • T1601.001 - Patch System Image
MITREへのリンク →

Star Blizzard

Score: 8.12
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1609 - Container Administration Command
MITREへのリンク →

SideCopy

Score: 5.01
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1584.002 - DNS Server
MITREへのリンク →

LazyScripter

Score: 5.21
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Moonstone Sleet

Score: 10.46
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1027 - Obfuscated Files or Information
  • T1197 - BITS Jobs
MITREへのリンク →

Machete

Score: 4.17
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

Tonto Team

Score: 5.96
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1547.011 - Plist Modification
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Sidewinder

Score: 8.62
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1090 - Proxy
  • T1601.001 - Patch System Image
  • T1578.001 - Create Snapshot
MITREへのリンク →

FIN7

Score: 18.50
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1562.001 - Disable or Modify Tools
  • T1027 - Obfuscated Files or Information
  • T1065 - Uncommonly Used Port
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
  • T1578.001 - Create Snapshot
MITREへのリンク →

APT37

Score: 4.17
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

CURIUM

Score: 7.27
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1578.001 - Create Snapshot
MITREへのリンク →

Silence

Score: 8.84
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1547.011 - Plist Modification
  • T1562.001 - Disable or Modify Tools
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

APT38

Score: 16.10
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1590 - Gather Victim Network Information
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1591.004 - Identify Roles
MITREへのリンク →

The White Company

Score: 3.47
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1578.001 - Create Snapshot
MITREへのリンク →

APT-C-36

Score: 3.27
Matched TTPs:
  • T1598.003 - Spearphishing Link
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

TeamTNT

Score: 17.55
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1098.007 - Additional Local or Domain Groups
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
  • T1022 - Data Encrypted
  • T1665 - Hide Infrastructure
MITREへのリンク →

Indrik Spider

Score: 9.90
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1183 - Image File Execution Options Injection
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1591.004 - Identify Roles
MITREへのリンク →

Poseidon Group

Score: 4.26
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

Storm-1811

Score: 12.38
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1027 - Obfuscated Files or Information
  • T1486 - Data Encrypted for Impact
  • T1030 - Data Transfer Size Limits
  • T1591.004 - Identify Roles
MITREへのリンク →

APT42

Score: 6.84
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1030 - Data Transfer Size Limits
MITREへのリンク →

Contagious Interview

Score: 20.32
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1021.006 - Windows Remote Management
  • T1183 - Image File Execution Options Injection
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1030 - Data Transfer Size Limits
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

ZIRCONIUM

Score: 10.84
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

RedEcho

Score: 3.92
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Silent Librarian

Score: 11.09
Matched TTPs:
  • T1098.007 - Additional Local or Domain Groups
  • T1183 - Image File Execution Options Injection
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
MITREへのリンク →

Medusa Group

Score: 15.72
Matched TTPs:
  • T1218.003 - CMSTP
  • T1009 - Binary Padding
  • T1183 - Image File Execution Options Injection
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1591.004 - Identify Roles
  • T1601.001 - Patch System Image
MITREへのリンク →

Rocke

Score: 12.72
Matched TTPs:
  • T1009 - Binary Padding
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027.004 - Compile After Delivery
  • T1022 - Data Encrypted
MITREへのリンク →

Velvet Ant

Score: 8.27
Matched TTPs:
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

BlackByte

Score: 11.57
Matched TTPs:
  • T1009 - Binary Padding
  • T1134.001 - Token Impersonation/Theft
  • T1597 - Search Closed Sources
  • T1027 - Obfuscated Files or Information
  • T1591.004 - Identify Roles
MITREへのリンク →

Leafminer

Score: 6.40
Matched TTPs:
  • T1101 - Security Support Provider
  • T1601.001 - Patch System Image
MITREへのリンク →

Deep Panda

Score: 6.03
Matched TTPs:
  • T1177 - LSASS Driver
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Axiom

Score: 7.82
Matched TTPs:
  • T1177 - LSASS Driver
  • T1160 - Launch Daemon
MITREへのリンク →

LAPSUS$

Score: 22.32
Matched TTPs:
  • T1020 - Automated Exfiltration
  • T1609 - Container Administration Command
  • T1556.008 - Network Provider DLL
  • T1030 - Data Transfer Size Limits
  • T1065 - Uncommonly Used Port
  • T1564.003 - Hidden Window
MITREへのリンク →

Blue Mockingbird

Score: 3.70
Matched TTPs:
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
MITREへのリンク →

Cinnamon Tempest

Score: 3.30
Matched TTPs:
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

APT18

Score: 4.80
Matched TTPs:
  • T1591.004 - Identify Roles
  • T1591.001 - Determine Physical Locations
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Kimsuky

Score: 0.70
Matched TTPs:
  • T1003.007 - Proc Filesystem
  • T1027.014 - Polymorphic Code
  • T1597 - Search Closed Sources
  • T1183 - Image File Execution Options Injection
  • T1027.004 - Compile After Delivery
  • T1665 - Hide Infrastructure
  • T1560.001 - Archive via Utility
  • T1591.004 - Identify Roles
  • T1546.011 - Application Shimming
  • T1197 - BITS Jobs
  • T1098.007 - Additional Local or Domain Groups
  • T1609 - Container Administration Command
  • T1030 - Data Transfer Size Limits
  • T1009 - Binary Padding
  • T1546.008 - Accessibility Features
  • T1213.006 - Databases
  • T1598.003 - Spearphishing Link
  • T1601.001 - Patch System Image
MITREへのリンク →

Sandworm Team

Score: 0.56
Matched TTPs:
  • T1027 - Obfuscated Files or Information
  • T1183 - Image File Execution Options Injection
  • T1484.002 - Trust Modification
  • T1686.003 - Windows Host Firewall
  • T1016.002 - Wi-Fi Discovery
  • T1075 - Pass the Hash
  • T1562.001 - Disable or Modify Tools
  • T1063 - Security Software Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1098.007 - Additional Local or Domain Groups
  • T1546.008 - Accessibility Features
  • T1598.003 - Spearphishing Link
  • T1601.001 - Patch System Image
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る