Mantis: New Tooling Used in Attacks Against Palestinian Targets

MITRE Techniques

• [T1566.001] Spearphishing via Attachment – Used spear-phishing emails to lure targets into installing malware on their devices. ‘The group is known for employing spear-phishing emails and fake social media profiles to lure targets into installing malware on their devices.’
• [T1059.001] Command and Scripting Interpreter: PowerShell – Three distinct sets of obfuscated PowerShell commands were executed to load a Base64-encoded string. ‘Three distinct sets of obfuscated PowerShell commands were executed to load a Base64-encoded string.’
• [T1105] Ingress Tool Transfer – A stage was downloaded from a C2 server via a basic TCP-based protocol. ‘a 32-bit stager that downloaded another stage using basic TCP-based protocol from a command-and-control (C&C) server: 104.194.222[.]50 port 4444.’
• [T1003] Credential Dumping – Attackers dumped credentials before downloading Micropsia and Putty. ‘dump credentials before downloading the Micropsia backdoor and Putty’
• [T1027] Obfuscated/Compressed Files and Information – Micropsia and associated tools were obfuscated (e.g., PyArmor). ‘obfuscated with PyArmor.’
• [T1547.001] Boot or Logon Autostart: Registry Run Keys – Persistence via registry Run keys. ‘SetRegRunKey.exe that provided persistence by adding Arid Gopher to the registry so that it executed on reboot.’
• [T1047] Windows Management Instrumentation – Micropsia executed using WMI. ‘Micropsia is executed using WMI’
• [T1113] Screen Capture – Taking screenshots as part of data collection. ‘taking screenshots’
• [T1056.001] Keylogging – Keylogging functionality observed in Micropsia.
• [T1560.001] Archive Collected Data – Archiving files with WinRAR for exfiltration. ‘archiving certain file types using WinRAR in preparation for data exfiltration’
• [T1090] Proxy – Use of reverse SOCKs tunnel to external IPs for C2 communications. ‘Reverse SOCKs Tunneler (aka Revsocks) (file name: windowsserv icemanageav.exe)’; ‘connects to external addresses … likely to register device/receive commands’
• [T1041] Exfiltration – Data exfiltration via compressed archives to C2 channels. ‘exfiltration of a RAR file’
• [T1133] External Remote Services – Use of Putty (SSH client) to facilitate remote access during the campaign. ‘Putty, a publicly available SSH client’