UNC3886

Targets

Sectors: Defence, Telecommunications

Regions: United States, Japan

Known techniques

• T1003.001LSASS Memory
• T1008Fallback Channels
• T1014Rootkit
• T1021.004SSH
• T1027.005Indicator Removal from Tools
• T1036.004Masquerade Task or Service
• T1037Boot or Logon Initialization Scripts
• T1037.004RC Scripts
• T1040Network Sniffing
• T1057Process Discovery
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.004Unix Shell
• T1059.006Python
• T1059.012Hypervisor CLI
• T1068Exploitation for Privilege Escalation
• T1070.004File Deletion
• T1070.006Timestomp
• T1070.007Clear Network Connection History and Configurations
• T1074.001Local Data Staging
• T1078Valid Accounts
• T1078.001Default Accounts
• T1083File and Directory Discovery
• T1095Non-Application Layer Protocol
• T1124System Time Discovery
• T1190Exploit Public-Facing Application
• T1203Exploitation for Client Execution
• T1205Traffic Signaling
• T1205.001Port Knocking
• T1212Exploitation for Credential Access
• T1218.011Rundll32
• T1505.006vSphere Installation Bundles
• T1548Abuse Elevation Control Mechanism
• T1554Compromise Host Software Binary
• T1555.005Password Managers
• T1560.001Archive via Utility
• T1560.003Archive via Custom Method
• T1564.011Ignore Process Interrupts
• T1570Lateral Tool Transfer
• T1587.001Malware

Malware and tools used