MITRE ATT&CKcampaign
C0016 Operation Dust Storm
- Domain
- enterprise, mobile
- Version
- 1.1
- Created
- 2022-09-29
Description
Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countries. By 2015, the Operation Dust Storm threat actors shifted from government and defense-related intelligence targets to Japanese companies or Japanese subdivisions of larger foreign organizations supporting Japan's critical infrastructure, including electricity generation, oil and natural gas, finance, transportation, and construction.
Operation Dust Storm threat actors also began to use Android backdoors in their operations by 2015, with all identified victims at the time residing in Japan or South Korea.
Related
Uses · MITRE ATT&CK (27)
- T1027.013 Encrypted/Encoded File sub-technique
- T1636.004 SMS Messages sub-technique
- T1646 Exfiltration Over C2 Channel technique
- T1585.002 Email Accounts sub-technique
- T1583.001 Domains sub-technique
- T1059.007 JavaScript sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1568 Dynamic Resolution technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1027.002 Software Packing sub-technique
- T1218.005 Mshta sub-technique
- T1533 Data from Local System technique
- T1518 Software Discovery technique
- T1189 Drive-by Compromise technique
- T1203 Exploitation for Client Execution technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1420 File and Directory Discovery technique
- S0012 PoisonIvy software (malware)
- S0032 gh0st RAT software (malware)
- S0083 Misdat software (malware)
- S0084 Mis-Type software (malware)
- S0085 S-Type software (malware)
- S0086 ZLib software (malware)
- T1036 Masquerading technique