TA2541

Targets

Sectors: Defence, Manufacturing, Aerospace, Transport

Known techniques

• T1016.001Internet Connection Discovery
• T1027.002Software Packing
• T1027.013Encrypted/Encoded File
• T1027.015Compression
• T1036.005Match Legitimate Resource Name or Location
• T1047Windows Management Instrumentation
• T1053.005Scheduled Task
• T1055Process Injection
• T1055.012Process Hollowing
• T1059.001PowerShell
• T1059.005Visual Basic
• T1082System Information Discovery
• T1105Ingress Tool Transfer
• T1204.001Malicious Link
• T1204.002Malicious File
• T1218.005Mshta
• T1518.001Security Software Discovery
• T1547.001Registry Run Keys / Startup Folder
• T1566.001Spearphishing Attachment
• T1566.002Spearphishing Link
• T1568Dynamic Resolution
• T1573.002Asymmetric Cryptography
• T1583.001Domains
• T1583.006Web Services
• T1588.001Malware
• T1588.002Tool
• T1608.001Upload Malware
• T1685Disable or Modify Tools

Malware and tools used