MITRE ATT&CKcampaign

C0015 C0015

Published 2022-09-29 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2022-09-29

Description

C0015 was a ransomware intrusion during which the unidentified attackers used Bazar, Cobalt Strike, and Conti, along with other tools, over a 5 day period. Security researchers assessed the actors likely used the widely-circulated Conti ransomware playbook based on the observed pattern of activity and operator errors.

Related

Uses · MITRE ATT&CK (39)

  • T1219.002 Remote Desktop Software sub-technique
  • S1040 Rclone software (tool)
  • S0575 Conti software (malware)
  • S0552 AdFind software (tool)
  • S0534 Bazar software (malware)
  • T1588.001 Malware sub-technique
  • T1588.002 Tool sub-technique
  • T1059.007 JavaScript sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1069.001 Local Groups sub-technique
  • T1204.002 Malicious File sub-technique
  • T1570 Lateral Tool Transfer technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.005 Visual Basic sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1069.002 Domain Groups sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1553.002 Code Signing sub-technique
  • T1218.005 Mshta sub-technique
  • T1218.010 Regsvr32 sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1486 Data Encrypted for Impact technique
  • T1482 Domain Trust Discovery technique
  • S0154 Cobalt Strike software (malware)
  • T1135 Network Share Discovery technique
  • T1005 Data from Local System technique
  • T1016 System Network Configuration Discovery technique
  • T1018 Remote System Discovery technique
Show all 39 ›

References