Trusted Design

Threat Actors Achieve Persistence After SQL Injection

概要

Threat actors gaining initial access through SQL injection exploited a web application vulnerability in a technology sector organization. After compromising an MSSQL instance via inadequate input validation, the attackers deployed base64-encoded PowerShell scripts to conduct reconnaissance using tasklist commands and exfiltrated results to an external server. They established persistence by enabling Remote Desktop Services, creating an administratively privileged user account named adminweb2$, and disabling Windows Defender. The attackers installed BadIIS modules for SEO fraud, deployed XMRig cryptocurrency miner with hidden file attributes, and utilized service creation tools. Multiple PowerShell scripts and batch files were downloaded throughout the attack to facilitate various malicious operations and maintain access.

Created: 2026-07-13

Indicators

類似Pulses

類似するPulseは見つかりませんでした。

このPulseに関連する脅威アクター (事実ベース)

HAFNIUM

Score: 18.65
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1171 - LLMNR/NBT-NS Poisoning and Relay
  • T1099 - Timestomp
  • T1487 - Disk Structure Wipe
  • T1590.006 - Network Security Appliances
  • T1608.005 - Link Target
  • T1210 - Exploitation of Remote Services
  • T1591.004 - Identify Roles
MITREへのリンク →

menuPass

Score: 17.12
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1527 - Application Access Token
  • T1487 - Disk Structure Wipe
  • T1547.011 - Plist Modification
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Wizard Spider

Score: 12.03
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1590.006 - Network Security Appliances
  • T1083 - File and Directory Discovery
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

APT33

Score: 6.51
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1051 - Shared Webroot
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Fox Kitten

Score: 10.70
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1177 - LSASS Driver
  • T1055.013 - Process Doppelgänging
  • T1051 - Shared Webroot
  • T1591.004 - Identify Roles
MITREへのリンク →

Volt Typhoon

Score: 29.24
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1686.003 - Windows Host Firewall
  • T1556.002 - Password Filter DLL
  • T1547.005 - Security Support Provider
  • T1590.006 - Network Security Appliances
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1065 - Uncommonly Used Port
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

APT1

Score: 11.22
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1587.003 - Digital Certificates
  • T1487 - Disk Structure Wipe
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Mustang Panda

Score: 34.06
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1596.001 - DNS/Passive DNS
  • T1487 - Disk Structure Wipe
  • T1546.011 - Application Shimming
  • T1136.001 - Local Account
  • T1590.006 - Network Security Appliances
  • T1055.013 - Process Doppelgänging
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1136.003 - Cloud Account
  • T1591.004 - Identify Roles
  • T1055.005 - Thread Local Storage
MITREへのリンク →

Play

Score: 9.25
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1590.006 - Network Security Appliances
  • T1597 - Search Closed Sources
  • T1574.009 - Path Interception by Unquoted Path
  • T1591.004 - Identify Roles
MITREへのリンク →

Chimera

Score: 16.56
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1587.003 - Digital Certificates
  • T1487 - Disk Structure Wipe
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

Sea Turtle

Score: 12.16
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1596.001 - DNS/Passive DNS
  • T1587.003 - Digital Certificates
  • T1137.004 - Outlook Home Page
MITREへのリンク →

APT39

Score: 11.77
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1547.011 - Plist Modification
  • T1055.013 - Process Doppelgänging
  • T1027.004 - Compile After Delivery
MITREへのリンク →

RedCurl

Score: 19.79
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1587.003 - Digital Certificates
  • T1487 - Disk Structure Wipe
  • T1016.002 - Wi-Fi Discovery
  • T1090 - Proxy
  • T1051 - Shared Webroot
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

APT5

Score: 6.87
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Agrius

Score: 9.12
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1487 - Disk Structure Wipe
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

GALLIUM

Score: 11.09
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1547.011 - Plist Modification
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

APT41

Score: 20.85
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1590.006 - Network Security Appliances
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1574.009 - Path Interception by Unquoted Path
  • T1030 - Data Transfer Size Limits
  • T1591.004 - Identify Roles
MITREへのリンク →

MuddyWater

Score: 23.28
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1518.002 - Backup Software Discovery
  • T1547.011 - Plist Modification
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

APT28

Score: 23.79
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1222.002 - Linux and Mac Permissions
  • T1487 - Disk Structure Wipe
  • T1131 - Authentication Package
  • T1547.011 - Plist Modification
  • T1608.005 - Link Target
  • T1574.009 - Path Interception by Unquoted Path
  • T1197 - BITS Jobs
  • T1591.004 - Identify Roles
MITREへのリンク →

Turla

Score: 22.50
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1099 - Timestomp
  • T1131 - Authentication Package
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

BRONZE BUTLER

Score: 13.12
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1592.004 - Client Configurations
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

UNC3886

Score: 31.82
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1596.001 - DNS/Passive DNS
  • T1689 - Downgrade Attack
  • T1556.002 - Password Filter DLL
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1090.002 - External Proxy
  • T1597 - Search Closed Sources
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

Kimsuky

Score: 48.21
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1109 - Component Firmware
  • T1213.006 - Databases
  • T1546.011 - Application Shimming
  • T1009 - Binary Padding
  • T1131 - Authentication Package
  • T1590.006 - Network Security Appliances
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
  • T1051 - Shared Webroot
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1027.014 - Polymorphic Code
  • T1030 - Data Transfer Size Limits
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1591.004 - Identify Roles
MITREへのリンク →

APT3

Score: 14.31
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1547.011 - Plist Modification
  • T1590.006 - Network Security Appliances
  • T1177 - LSASS Driver
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1591.004 - Identify Roles
MITREへのリンク →

FIN8

Score: 5.29
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1591.004 - Identify Roles
MITREへのリンク →

Ke3chang

Score: 23.44
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1584.008 - Network Devices
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1487 - Disk Structure Wipe
  • T1590.006 - Network Security Appliances
  • T1055.013 - Process Doppelgänging
  • T1198 - SIP and Trust Provider Hijacking
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

Lotus Blossom

Score: 10.58
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1109 - Component Firmware
  • T1099 - Timestomp
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

FIN13

Score: 24.52
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1547.005 - Security Support Provider
  • T1590.006 - Network Security Appliances
  • T1144 - Gatekeeper Bypass
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1134.001 - Token Impersonation/Theft
  • T1591.004 - Identify Roles
MITREへのリンク →

Earth Lusca

Score: 11.12
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1546.013 - PowerShell Profile
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1027.004 - Compile After Delivery
MITREへのリンク →

Magic Hound

Score: 34.86
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1171 - LLMNR/NBT-NS Poisoning and Relay
  • T1099 - Timestomp
  • T1587.003 - Digital Certificates
  • T1016.002 - Wi-Fi Discovery
  • T1010 - Application Window Discovery
  • T1547.005 - Security Support Provider
  • T1009 - Binary Padding
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1591.004 - Identify Roles
MITREへのリンク →

Aquatic Panda

Score: 8.19
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1144 - Gatekeeper Bypass
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

INC Ransom

Score: 9.70
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1083 - File and Directory Discovery
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

Akira

Score: 3.39
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1597 - Search Closed Sources
MITREへのリンク →

ToddyCat

Score: 6.62
Matched TTPs:
  • T1560.001 - Archive via Utility
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

APT29

Score: 36.62
Matched TTPs:
  • T1222.002 - Linux and Mac Permissions
  • T1099 - Timestomp
  • T1584.008 - Network Devices
  • T1202 - Indirect Command Execution
  • T1547.011 - Plist Modification
  • T1177 - LSASS Driver
  • T1592.004 - Client Configurations
  • T1608.005 - Link Target
  • T1556.008 - Network Provider DLL
  • T1027.004 - Compile After Delivery
  • T1223 - Compiled HTML File
MITREへのリンク →

Scattered Spider

Score: 48.93
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
  • T1109 - Component Firmware
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1547.005 - Security Support Provider
  • T1590.006 - Network Security Appliances
  • T1144 - Gatekeeper Bypass
  • T1609 - Container Administration Command
  • T1083 - File and Directory Discovery
  • T1051 - Shared Webroot
  • T1556.008 - Network Provider DLL
  • T1210 - Exploitation of Remote Services
  • T1597 - Search Closed Sources
  • T1030 - Data Transfer Size Limits
  • T1197 - BITS Jobs
  • T1022 - Data Encrypted
MITREへのリンク →

FIN4

Score: 4.13
Matched TTPs:
  • T1666 - Modify Cloud Resource Hierarchy
MITREへのリンク →

Andariel

Score: 5.58
Matched TTPs:
  • T1171 - LLMNR/NBT-NS Poisoning and Relay
  • T1055.004 - Asynchronous Procedure Call
MITREへのリンク →

APT32

Score: 25.69
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.005 - Security Support Provider
  • T1131 - Authentication Package
  • T1590.006 - Network Security Appliances
  • T1055.013 - Process Doppelgänging
  • T1592.004 - Client Configurations
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
MITREへのリンク →

Saint Bear

Score: 12.11
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1055.013 - Process Doppelgänging
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1030 - Data Transfer Size Limits
  • T1591.004 - Identify Roles
MITREへのリンク →

FIN6

Score: 9.25
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1487 - Disk Structure Wipe
  • T1055.013 - Process Doppelgänging
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

Sidewinder

Score: 11.51
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1487 - Disk Structure Wipe
  • T1590.006 - Network Security Appliances
  • T1090 - Proxy
  • T1578.001 - Create Snapshot
MITREへのリンク →

Winter Vivern

Score: 14.03
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1587.003 - Digital Certificates
  • T1487 - Disk Structure Wipe
  • T1055.013 - Process Doppelgänging
  • T1090 - Proxy
  • T1591.004 - Identify Roles
MITREへのリンク →

Silence

Score: 8.07
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.011 - Plist Modification
  • T1562.001 - Disable or Modify Tools
  • T1591.004 - Identify Roles
MITREへのリンク →

Contagious Interview

Score: 20.72
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1547.005 - Security Support Provider
  • T1131 - Authentication Package
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1030 - Data Transfer Size Limits
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

LazyScripter

Score: 7.69
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1608.005 - Link Target
  • T1591.004 - Identify Roles
MITREへのリンク →

TA505

Score: 14.71
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1527 - Application Access Token
  • T1016.002 - Wi-Fi Discovery
  • T1051 - Shared Webroot
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

FIN7

Score: 20.98
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1009 - Binary Padding
  • T1055.013 - Process Doppelgänging
  • T1608.005 - Link Target
  • T1562.001 - Disable or Modify Tools
  • T1065 - Uncommonly Used Port
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

Cobalt Group

Score: 12.55
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1518.002 - Backup Software Discovery
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
MITREへのリンク →

Higaisa

Score: 6.99
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1590.006 - Network Security Appliances
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

Indrik Spider

Score: 7.25
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1051 - Shared Webroot
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

Leafminer

Score: 9.03
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1101 - Security Support Provider
  • T1051 - Shared Webroot
MITREへのリンク →

TA578

Score: 3.99
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1608.005 - Link Target
MITREへのリンク →

Evilnum

Score: 5.01
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1109 - Component Firmware
MITREへのリンク →

Star Blizzard

Score: 11.37
Matched TTPs:
  • T1546.013 - PowerShell Profile
  • T1109 - Component Firmware
  • T1547.005 - Security Support Provider
  • T1609 - Container Administration Command
MITREへのリンク →

LuminousMoth

Score: 9.62
Matched TTPs:
  • T1109 - Component Firmware
  • T1596.001 - DNS/Passive DNS
  • T1574.009 - Path Interception by Unquoted Path
MITREへのリンク →

Sandworm Team

Score: 27.15
Matched TTPs:
  • T1109 - Component Firmware
  • T1484.002 - Trust Modification
  • T1686.003 - Windows Host Firewall
  • T1016.002 - Wi-Fi Discovery
  • T1546.008 - Accessibility Features
  • T1055.004 - Asynchronous Procedure Call
  • T1562.001 - Disable or Modify Tools
  • T1075 - Pass the Hash
MITREへのリンク →

APT42

Score: 7.54
Matched TTPs:
  • T1109 - Component Firmware
  • T1590.006 - Network Security Appliances
  • T1030 - Data Transfer Size Limits
MITREへのリンク →

HEXANE

Score: 12.50
Matched TTPs:
  • T1099 - Timestomp
  • T1547.005 - Security Support Provider
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1065 - Uncommonly Used Port
MITREへのリンク →

Gamaredon Group

Score: 23.36
Matched TTPs:
  • T1099 - Timestomp
  • T1527 - Application Access Token
  • T1487 - Disk Structure Wipe
  • T1090 - Proxy
  • T1608.005 - Link Target
  • T1554 - Compromise Host Software Binary
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1591.004 - Identify Roles
MITREへのリンク →

TA2541

Score: 6.56
Matched TTPs:
  • T1099 - Timestomp
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
MITREへのリンク →

Mustard Tempest

Score: 4.54
Matched TTPs:
  • T1682 - Query Public AI Services
MITREへのリンク →

Dragonfly

Score: 16.17
Matched TTPs:
  • T1584.008 - Network Devices
  • T1009 - Binary Padding
  • T1590.006 - Network Security Appliances
  • T1055.013 - Process Doppelgänging
  • T1531 - Account Access Removal
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

Threat Group-3390

Score: 20.64
Matched TTPs:
  • T1584.008 - Network Devices
  • T1487 - Disk Structure Wipe
  • T1010 - Application Window Discovery
  • T1218.003 - CMSTP
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1574.009 - Path Interception by Unquoted Path
  • T1591.004 - Identify Roles
MITREへのリンク →

Ember Bear

Score: 14.24
Matched TTPs:
  • T1584.008 - Network Devices
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1487 - Disk Structure Wipe
  • T1051 - Shared Webroot
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

Silent Librarian

Score: 10.44
Matched TTPs:
  • T1596.001 - DNS/Passive DNS
  • T1546.008 - Accessibility Features
  • T1609 - Container Administration Command
MITREへのリンク →

Lazarus Group

Score: 33.71
Matched TTPs:
  • T1596.001 - DNS/Passive DNS
  • T1009 - Binary Padding
  • T1547.011 - Plist Modification
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1608.005 - Link Target
  • T1210 - Exploitation of Remote Services
  • T1069.001 - Local Groups
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1591.004 - Identify Roles
  • T1055.005 - Thread Local Storage
  • T1578.001 - Create Snapshot
MITREへのリンク →

BlackTech

Score: 3.15
Matched TTPs:
  • T1596.001 - DNS/Passive DNS
MITREへのリンク →

OilRig

Score: 20.83
Matched TTPs:
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1487 - Disk Structure Wipe
  • T1009 - Binary Padding
  • T1590.006 - Network Security Appliances
  • T1055.013 - Process Doppelgänging
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1592.002 - Software
  • T1591.004 - Identify Roles
MITREへのリンク →

Tropic Trooper

Score: 16.51
Matched TTPs:
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1487 - Disk Structure Wipe
  • T1590.006 - Network Security Appliances
  • T1090 - Proxy
  • T1055.004 - Asynchronous Procedure Call
  • T1136.003 - Cloud Account
  • T1591.004 - Identify Roles
MITREへのリンク →

APT18

Score: 3.70
Matched TTPs:
  • T1195.001 - Compromise Software Dependencies and Development Tools
  • T1591.004 - Identify Roles
MITREへのリンク →

Storm-0501

Score: 15.26
Matched TTPs:
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1686.003 - Windows Host Firewall
  • T1027.014 - Polymorphic Code
  • T1158 - Hidden Files and Directories
MITREへのリンク →

Leviathan

Score: 11.01
Matched TTPs:
  • T1484.002 - Trust Modification
  • T1554 - Compromise Host Software Binary
  • T1027.014 - Polymorphic Code
MITREへのリンク →

FIN5

Score: 7.27
Matched TTPs:
  • T1487 - Disk Structure Wipe
  • T1547.011 - Plist Modification
  • T1055.013 - Process Doppelgänging
MITREへのリンク →

Confucius

Score: 4.20
Matched TTPs:
  • T1487 - Disk Structure Wipe
  • T1608.005 - Link Target
MITREへのリンク →

Patchwork

Score: 3.14
Matched TTPs:
  • T1487 - Disk Structure Wipe
  • T1591.004 - Identify Roles
MITREへのリンク →

Medusa Group

Score: 12.71
Matched TTPs:
  • T1218.003 - CMSTP
  • T1009 - Binary Padding
  • T1590.006 - Network Security Appliances
  • T1608.005 - Link Target
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

LAPSUS$

Score: 21.00
Matched TTPs:
  • T1547.005 - Security Support Provider
  • T1609 - Container Administration Command
  • T1556.008 - Network Provider DLL
  • T1137.004 - Outlook Home Page
  • T1030 - Data Transfer Size Limits
  • T1065 - Uncommonly Used Port
MITREへのリンク →

Rocke

Score: 12.72
Matched TTPs:
  • T1009 - Binary Padding
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
  • T1027.004 - Compile After Delivery
  • T1022 - Data Encrypted
MITREへのリンク →

TeamTNT

Score: 14.66
Matched TTPs:
  • T1009 - Binary Padding
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1051 - Shared Webroot
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
  • T1022 - Data Encrypted
MITREへのリンク →

Moses Staff

Score: 3.81
Matched TTPs:
  • T1009 - Binary Padding
  • T1590.006 - Network Security Appliances
MITREへのリンク →

APT38

Score: 15.90
Matched TTPs:
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1590 - Gather Victim Network Information
  • T1597 - Search Closed Sources
  • T1493 - Transmitted Data Manipulation
  • T1591.004 - Identify Roles
MITREへのリンク →

Velvet Ant

Score: 8.27
Matched TTPs:
  • T1009 - Binary Padding
  • T1055.004 - Asynchronous Procedure Call
  • T1597 - Search Closed Sources
  • T1562.001 - Disable or Modify Tools
MITREへのリンク →

BlackByte

Score: 10.69
Matched TTPs:
  • T1009 - Binary Padding
  • T1590.006 - Network Security Appliances
  • T1134.001 - Token Impersonation/Theft
  • T1597 - Search Closed Sources
  • T1591.004 - Identify Roles
MITREへのリンク →

SilverTerrier

Score: 3.29
Matched TTPs:
  • T1131 - Authentication Package
MITREへのリンク →

Tonto Team

Score: 5.09
Matched TTPs:
  • T1547.011 - Plist Modification
  • T1027.004 - Compile After Delivery
MITREへのリンク →

admin@338

Score: 4.16
Matched TTPs:
  • T1590.006 - Network Security Appliances
  • T1055.004 - Asynchronous Procedure Call
  • T1591.004 - Identify Roles
MITREへのリンク →

APT19

Score: 6.56
Matched TTPs:
  • T1590.006 - Network Security Appliances
  • T1055.013 - Process Doppelgänging
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Stealth Falcon

Score: 3.81
Matched TTPs:
  • T1590.006 - Network Security Appliances
  • T1055.013 - Process Doppelgänging
MITREへのリンク →

Moonstone Sleet

Score: 4.91
Matched TTPs:
  • T1590.006 - Network Security Appliances
  • T1197 - BITS Jobs
MITREへのリンク →

Darkhotel

Score: 5.02
Matched TTPs:
  • T1590.006 - Network Security Appliances
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

ZIRCONIUM

Score: 12.81
Matched TTPs:
  • T1590.006 - Network Security Appliances
  • T1608.005 - Link Target
  • T1027.004 - Compile After Delivery
  • T1197 - BITS Jobs
  • T1591.004 - Identify Roles
  • T1578.001 - Create Snapshot
MITREへのリンク →

Deep Panda

Score: 6.03
Matched TTPs:
  • T1177 - LSASS Driver
  • T1027.014 - Polymorphic Code
MITREへのリンク →

Axiom

Score: 3.29
Matched TTPs:
  • T1177 - LSASS Driver
MITREへのリンク →

APT37

Score: 5.64
Matched TTPs:
  • T1055.013 - Process Doppelgänging
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

WIRTE

Score: 5.14
Matched TTPs:
  • T1562.001 - Disable or Modify Tools
  • T1027.014 - Polymorphic Code
MITREへのリンク →

DarkHydrus

Score: 4.13
Matched TTPs:
  • T1531 - Account Access Removal
MITREへのリンク →

TA551

Score: 3.70
Matched TTPs:
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
MITREへのリンク →

Blue Mockingbird

Score: 3.70
Matched TTPs:
  • T1027.014 - Polymorphic Code
  • T1591.004 - Identify Roles
MITREへのリンク →

Storm-1811

Score: 8.53
Matched TTPs:
  • T1486 - Data Encrypted for Impact
  • T1030 - Data Transfer Size Limits
  • T1591.004 - Identify Roles
MITREへのリンク →

Machete

Score: 3.30
Matched TTPs:
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

Cinnamon Tempest

Score: 3.30
Matched TTPs:
  • T1027.004 - Compile After Delivery
  • T1591.004 - Identify Roles
MITREへのリンク →

このPulseに関連する脅威アクター (推論ベース)

Scattered Spider

Score: 0.70
Matched TTPs:
  • T1547.005 - Security Support Provider
  • T1083 - File and Directory Discovery
  • T1210 - Exploitation of Remote Services
  • T1144 - Gatekeeper Bypass
  • T1109 - Component Firmware
  • T1022 - Data Encrypted
  • T1030 - Data Transfer Size Limits
  • T1666 - Modify Cloud Resource Hierarchy
  • T1609 - Container Administration Command
  • T1685.004 - Disable or Modify Linux Audit System Log
  • T1051 - Shared Webroot
  • T1590.006 - Network Security Appliances
  • T1197 - BITS Jobs
  • T1556.008 - Network Provider DLL
  • T1597 - Search Closed Sources
MITREへのリンク →

Kimsuky

Score: 0.69
Matched TTPs:
  • T1546.011 - Application Shimming
  • T1591.004 - Identify Roles
  • T1131 - Authentication Package
  • T1109 - Component Firmware
  • T1027.014 - Polymorphic Code
  • T1030 - Data Transfer Size Limits
  • T1051 - Shared Webroot
  • T1609 - Container Administration Command
  • T1546.013 - PowerShell Profile
  • T1009 - Binary Padding
  • T1590.006 - Network Security Appliances
  • T1546.008 - Accessibility Features
  • T1608.005 - Link Target
  • T1197 - BITS Jobs
  • T1560.001 - Archive via Utility
  • T1213.006 - Databases
  • T1027.004 - Compile After Delivery
  • T1597 - Search Closed Sources
MITREへのリンク →

Related CVEs

このPulseに見つかったCVEはありません。

Pulse – 脅威アクター グラフ

← Pulse一覧に戻る