APT28, an evolution of tradecraft

MITRE Techniques

• [T1566.001] Spearphishing Attachment – Delivered malware and lures through malicious email attachments and documents, including Office files and PDFs (‘spear phishing campaigns… delivered the Seduploader first stage’ and ‘weaponised Office documents through private Signal Desktop chats’).
• [T1190] Exploit Public-Facing Application – Used webmail XSS flaws and Outlook flaws to gain access or trigger exfiltration (‘weaponized XSS flaws in widely-deployed webmail platforms’ and ‘weaponised the zero-click Outlook flaw CVE-2023-23397’).
• [T1055] Process Injection – Deployed Covenant in memory during the Phantom Net Voxel chain (‘stages a customised Covenant framework deployment in memory’).
• [T1021.006] Remote Services: Windows Remote Management / SMB-based authentication abuse – Forced Outlook clients to authenticate to attacker-controlled SMB shares and relayed hashes (‘Crafted Outlook reminders force the client to authenticate to attacker-controlled SMB shares’).
• [T1110] Brute Force – Harvested and reused credentials at scale through credential-stealing operations (‘credential harvesting campaign’ and ‘harvesting credentials for later reuse’).
• [T1003] OS Credential Dumping – Used Mimikatz and harvested Net-NTLMv2 hashes and browser credentials (‘Mimikatz for credential theft’ and ‘capture Net-NTLMv2 hashes’).
• [T1041] Exfiltration Over C2 Channel – Exfiltrated stolen data, inbox contents, and credentials to attacker infrastructure (‘silently exfiltrate inboxes, contacts, and credentials’ and ‘exfiltrated over SFTP or HTTP’).
• [T1027] Obfuscated Files or Information – Used encoded prompts and multi-language rewrites to conceal payload logic (‘base64-encoded natural-language prompts’ and ‘rewritten across many languages’).
• [T1090] Proxy – Relayed traffic and hashes through compromised routers and EdgeRouters (‘relaying them via compromised EdgeRouters’ and ‘traffic proxying’).
• [T1098] Account Manipulation – Enabled IMAP and stored app passwords after 2FA bypass (‘validates the second factor, enables IMAP, stores the new app password’).
• [T1105] Ingress Tool Transfer – Downloaded and staged components such as loaders, backdoors, and Python scripts (‘Python downloader’ and ‘staging custom Python scripts’).
• [T1546.007] Event Triggered Execution: Netsh Helper DLL / WMI? – Not explicitly present; omitted.
• [T1053] Scheduled Task/Job – Not explicitly mentioned in the article; omitted.