Confucius

Names and who uses them

• ConfuciusOur name
• Confucius APTMITRE ATT&CK

Targets

Sectors: Government, Defence

Regions: South Asia

Known techniques

• T1041Exfiltration Over C2 Channel
• T1053.005Scheduled Task
• T1059.001PowerShell
• T1059.005Visual Basic
• T1071.001Web Protocols
• T1083File and Directory Discovery
• T1105Ingress Tool Transfer
• T1119Automated Collection
• T1203Exploitation for Client Execution
• T1204.001Malicious Link
• T1204.002Malicious File
• T1218.005Mshta
• T1221Template Injection
• T1547.001Registry Run Keys / Startup Folder
• T1566.001Spearphishing Attachment
• T1566.002Spearphishing Link
• T1567.002Exfiltration to Cloud Storage
• T1583.006Web Services
• T1680Local Storage Discovery

Malware and tools used