Ongoing Social Engineering Campaign Updates Payloads

MITRE Techniques

• [T1587.001] Develop Capabilities: Malware – The threat actor is actively developing new malware to distribute. ‘The threat actor is actively developing new malware to distribute.’
• [T1498] Network Denial of Service – The threat actor overwhelms email protection solutions with spam. ‘The threat actor overwhelms email protection solutions with spam.’
• [T1566.004] Phishing: Spearphishing Voice – The threat actor calls impacted users and pretends to be a member of their organization’s IT team to gain remote access. ‘The threat actor calls impacted users and pretends to be a member of their organization’s IT team to gain remote access.’
• [T1059.001] Command and Scripting Interpreter: PowerShell – The threat actor executes a socks proxy PowerShell script. ‘The threat actor executes a socks proxy PowerShell script.’
• [T1140] Deobfuscate/Decode Files or Information – The threat actor encrypts zip archive payloads with a password. ‘The threat actor encrypts zip archive payloads with a password.’
• [T1055.002] Process Injection: Portable Executable Injection – Multiple payloads executed by the threat actor utilize local PE injection. ‘Multiple payloads executed by the threat actor utilize local PE injection.’
• [T1620] Reflective Code Loading – Multiple payloads executed by the threat actor load and execute shellcode. ‘Multiple payloads executed by the threat actor load and execute shellcode.’
• [T1553.002] Subvert Trust Controls: Code Signing – The threat actor has signed many of their payloads to make them appear legitimate. ‘The threat actor has signed many of their payloads to make them appear legitimate.’
• [T1068] Exploitation for Privilege Escalation – The threat actor attempts to exploit CVE-2022-26923 to create a machine account. ‘The threat actor attempts to exploit CVE-2022-26923 to create a machine account.’
• [T1056.001] Input Capture: Keylogging – The threat actor runs an executable that harvests the user’s credentials. ‘The threat actor runs an executable that harvests the user’s credentials.’
• [T1558.003] Steal or Forge Kerberos Tickets: Kerberoasting – The threat actor requests a large volume of Kerberos service tickets once privileges have been escalated. ‘The threat actor requests a large volume of Kerberos service tickets once privileges have been escalated.’
• [T1033] System Owner/User Discovery – The threat actor enumerates users within the environment. ‘The threat actor enumerates users within the environment.’
• [T1570] Lateral Tool Transfer – Anydesk was used to move payloads onto compromised systems. ‘Anydesk was used to move payloads onto compromised systems.’
• [T1572] Protocol Tunneling – SSH reverse tunnels were used to provide the threat actor with remote access. ‘SSH reverse tunnels were used to provide the threat actor with remote access.’
• [T1219] Remote Access Software – The threat actor has used Anydesk to gain initial access and Level to move laterally. ‘The threat actor has used Anydesk to gain initial access and Level to move laterally.’