MITRE ATT&CKcampaign
C0013 Operation Sharpshooter
- Domain
- enterprise
- Version
- 1.0
- Created
- 2022-09-26
Description
Operation Sharpshooter was a global cyber espionage campaign that targeted nuclear, defense, government, energy, and financial companies, with many located in Germany, Turkey, the United Kingdom, and the United States. Security researchers noted the campaign shared many similarities with previous Lazarus Group operations, including fake job recruitment lures and shared malware code.
Related
Uses · MITRE ATT&CK (14)
- T1608.001 Upload Malware sub-technique
- T1583.006 Web Services sub-technique
- T1584.004 Server sub-technique
- T1587.001 Malware sub-technique
- S0448 Rising Sun software (malware)
- T1204.002 Malicious File sub-technique
- T1059.005 Visual Basic sub-technique
- T1559.002 Dynamic Data Exchange sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1055 Process Injection technique
- T1090 Proxy technique
- T1105 Ingress Tool Transfer technique
- T1106 Native API technique
References
- https://www.bleepingcomputer.com/news/security/op-sharpshooter-connected-to-north-koreas-lazarus-group/ Bleeping Computer Op Sharpshooter March 2019
- https://threatpost.com/sharpshooter-complexity-scope/142359/ Threatpost New Op Sharpshooter Data March 2019
- https://www.mcafee.com/enterprise/en-us/assets/reports/rp-operation-sharpshooter.pdf McAfee Sharpshooter December 2018