MITRE ATT&CKcampaign

C0005 Operation Spalax

Published 2022-09-16 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.1
Created
2022-09-16

Description

Operation Spalax was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The Operation Spalax threat actors distributed commodity malware and tools using generic phishing topics related to COVID-19, banking, and law enforcement action. Security researchers noted indicators of compromise and some infrastructure overlaps with other campaigns dating back to April 2018, including at least one separately attributed to APT-C-36, however identified enough differences to report this as separate, unattributed activity.

Related

Uses · MITRE ATT&CK (19)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1608.001 Upload Malware sub-technique
  • T1588.001 Malware sub-technique
  • T1588.002 Tool sub-technique
  • T1583.001 Domains sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1204.002 Malicious File sub-technique
  • T1568 Dynamic Resolution technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1027.002 Software Packing sub-technique
  • T1027.003 Steganography sub-technique
  • T1218.011 Rundll32 sub-technique
  • S0385 njRAT software (malware)
  • T1497 Virtualization/Sandbox Evasion technique
  • S0332 Remcos software (tool)
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1059 Command and Scripting Interpreter technique
  • T1102 Web Service technique

References