MITRE ATT&CKcampaign
C0004 CostaRicto
- Domain
- enterprise
- Version
- 1.0
- Created
- 2022-09-15
Description
CostaRicto was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. CostaRicto actors targeted organizations in Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia (especially India, Bangladesh, and Singapore), using custom malware, open source tools, and a complex network of proxies and SSH tunnels.
Related
Uses · MITRE ATT&CK (16)
- S0615 SombRAT software (malware)
- S0613 PS1 software (malware)
- S0614 CostaBricks software (malware)
- T1587.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1572 Protocol Tunneling technique
- T1090.003 Multi-hop Proxy sub-technique
- T1053.005 Scheduled Task sub-technique
- S0194 PowerSploit software (tool)
- S0183 Tor software (tool)
- S0029 PsExec software (tool)
- T1005 Data from Local System technique
- T1046 Network Service Discovery technique
- T1105 Ingress Tool Transfer technique
- T1133 External Remote Services technique
References
- https://blogs.blackberry.com/en/2020/11/the-costaricto-campaign-cyber-espionage-outsourced BlackBerry CostaRicto November 2020