Month: July 2023

Technique Title 

ID 

Use 

Initial Access 

Replication Through Removable Media 

T1091

Cyber threat actors use removable media drives to deploy Raspberry Robin malware. 

Drive-by Compromise 

T1189 

Cyber threat actors embed malicious links or attachments within web domains to gain initial access. 

Exploit Public-Facing Application 

T1190 

Cyber threat actors are exploiting Netwrix vulnerability CVE-2022-31199 for initial access with follow-on capabilities of lateral movement through remote code execution. 

Phishing 

T1566.002 

Truebot actors can send spear phishing links to gain initial access. 

Execution 

Command and Scripting Interpreter 

T1059 

Cyber threat actors have been observed dropping cobalt strike beacons as a reverse shell proxy to create persistence within the compromised network. 

Cyber threat actors use FlawedGrace to receive PowerShell commands over a C2 channel to deploy additional tools. 

Shared Modules 

T1129 

Cyber threat actors can deploy malicious payloads through obfuscated share modules. 

User Execution: Malicious Link 

T1204.001 

Cyber threat actors trick users into clicking a link by making them believe they need to perform a Google Chrome software update. 

Persistence 

Hijack Execution Flow: DLL Side-Loading 

T1574.002 

Cyber threat actors use Raspberry Robin, among other toolsets to side-load DLLs to maintain persistence. 

Privilege Escalation 

Boot or Logon Autostart Execution: Print Processors 

T1547.012 

FlawedGrace malware manipulates print spooler functions to achieve privilege escalation. 

Defense Evasion 

Obfuscated Files or Information 

T1027 

Truebot uses a .JSONIP extension (e.g., IgtyXEQuCEvAM.JSONIP), to create a GUID. 

Obfuscated Files or Information: Binary Padding 

T1027.001 

Cyber threat actors embed around one gigabyte of junk code within the malware string to evade detection protocols. 

Masquerading: Masquerade File Type 

T1036.008 

Cyber threat actors hide Truebot malware as legitimate appearing file formats. 

Process Injection 

T1055 

Truebot malware has the ability to load shell code after establishing a C2 connection. 

Indicator Removal: File Deletion 

T1070.004 

Truebot malware implements self-deletion TTPs throughout its attack cycle to evade detection. 

Teleport exfiltration tool deletes itself after it has completed exfiltrating data to the C2 station. 

Modify Registry 

T1112 

FlawedGrace is able to modify registry programs that control the order that documents are loaded to a print que. 

Reflective Code Loading 

T1620 

Truebot malware has the capability to load shell code and deploy various tools to stealthily navigate an infected network. 

Credential Access 

OS Credential Dumping: LSASS Memory 

T1003.001 

Cyber threat actors use cobalt strike to gain valid credentials through LSASS memory dumping. 

Discovery 

System Network Configuration Discovery 

T1016 

Truebot malware scans and enumerates the affected system’s domain names. 

Process Discovery 

T1057 

Truebot malware enumerates all running processes on the local host. 

System Information Discovery 

T1082 

Truebot malware scans and enumerates the OS version information, and processor architecture. 

Truebot malware enumerates the affected system’s computer names. 

System Time Discovery 

T1124 

Truebot has the ability to discover system time metrics, which aids in enables synchronization with the compromised system’s internal clock to facilitate scheduling tasks. 

Software Discovery: Security Software Discovery 

T1518.001 

Truebot has the ability to discover software security protocols, which aids in defense evasion. 

Debugger Evasion 

T1622 

Truebot malware scans the compromised environment for debugger tools and enumerates them in effort to evade network defenses. 

Lateral Movement 

Exploitation of Remote Services 

T1210 

Cyber threat actors exploit CVE-2022-31199 Netwrix Auditor vulnerability and use its capabilities to move laterally within a compromised network. 

Use Alternate Authentication Material: Pass the Hash 

T1550.002 

Cyber threat actors use cobalt strike to authenticate valid accounts 

Remote Service Session Hijacking 

T1563.001 

Cyber threat actors use cobalt strike to hijack remote sessions using SSH and RDP hijacking methods. 

Remote Service Session Hijacking: RDP Hijacking 

T1563.002 

Cyber threat actors use cobalt strike to hijack remote sessions using SSH and RDP hijacking methods. 

Lateral Tool Transfer 

T1570 

Cyber threat actors deploy additional payloads to transfer toolsets and move laterally. 

Collection 

Data from Local System 

T1005 

Truebot malware checks the current version of the OS and the processor architecture and compiles the information it receives. 

Screen Capture 

T1113 

Truebot malware takes snapshots of local host data, specifically processor architecture data, and sends that to a phase 2 encoded data string. 

Truebot gathers and compiles compromised system’s host and domain names. 

Command and Control 

Application Layer Protocol 

T1071 

Cyber threat actors use teleport exfiltration tool to blend exfiltrated data with network traffic. 

Non-Application Protocol 

T1095 

Cyber threat actors use Teleport and FlawedGrace to send data over custom communication protocol. 

Ingress Transfer Tool 

T1105 

Cyber threat actors deploy various ingress transfer tool payloads to move laterally and establish C2 connections. 

Encrypted Channel: Asymmetric Cryptography 

T1573.002 

Cyber threat actors use Teleport to create an encrypted channel using AES. 

Exfiltration 

Scheduled Transfer 

T1029 

Teleport limits the data it collects and syncs with outbound organizational data/network traffic. 

Data Transfer Size Limits 

T1030 

Teleport limits the data it collects and syncs with outbound organizational data/network traffic. 

Exfiltration Over C2 Channel 

T1048 

Cyber threat actors blend exfiltrated data with network traffic to evade detection. 

Cyber threat actors use the Teleport tool to exfiltrate data over a C2 protocol.