Tracking TamperedChef Clusters via Certificate and Code Reuse

MITRE Techniques

• [T1583.001 ] Acquire Infrastructure: Domains – Attackers used legitimate-looking websites and unique campaign domains to host and distribute fake productivity apps (‘distributing via well-built, legitimate-looking websites’ and ‘leveraging unique and contextually relevant domains for each campaign’).
• [T1071.001 ] Application Layer Protocol: Web Protocols – Campaigns used continuous C2 methods and upstream APIs to retrieve and run additional payloads (‘continuous command and control (C2) methods’ and ‘trigger the next stage… delivered via an upstream API’).
• [T1204.002 ] User Execution: Malicious File – Victims were lured into downloading and running trojanized productivity software from ads and search results (‘malicious ads that direct users to sites hosting the applications’).
• [T1112 ] Modify Registry – Persistence was often implemented through registry Run keys (‘implementing a robust persistence mechanism, almost always through scheduled tasks or registry Run keys’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – The malware established persistence by creating scheduled tasks (‘implementing a robust persistence mechanism, almost always through scheduled tasks’).
• [T1027 ] Obfuscated Files or Information – Samples used obfuscation to hide malicious components and command strings (‘obfuscating the malicious components’ and ‘homoglyphs to obfuscate the incoming command strings’).
• [T1036 ] Masquerading – Malware pretended to be legitimate productivity applications and used legitimate-looking branding, pages, and licensing terms (‘fake productivity applications’ and ‘appearing modern and credible’).
• [T1587.001 ] Develop Capabilities: Malware – The actors created many custom variants and codebases for productivity-app malware (‘over 100 unique variants’ and ‘new codebase for each campaign’).
• [T1113 ] Screen Capture – Some payloads gathered screen-related details from victims (‘screen size’).
• [T1005 ] Data from Local System – Initial information gathering collected system and host details from infected machines (‘system version, hostname and active browsers’).
• [T1016 ] System Network Configuration Discovery – Some campaigns collected geolocation and domain information from the environment (‘domain information, geolocation’).
• [T1041 ] Exfiltration Over C2 Channel – Data and credentials were exfiltrated through malicious command-and-control infrastructure (‘exfiltrate users’ credentials’ and ‘continuous command and control’).
• [T1219 ] Remote Access Software – The second stage often included RATs or access-broker-like behavior (‘deploying… remote access Trojans (RATs)’ and ‘behavior that resembles access brokers’).
• [T1021 ] Remote Services – The malware enabled remote command execution and control over victim systems (‘execute commands remotely’).