MITRE ATT&CKcampaign

C0017 C0017

Published 2022-12-01 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2022-12-01

Description

C0017 was an APT41 campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through the exploitation of vulnerable Internet facing web applications. During C0017, APT41 was quick to adapt and use publicly-disclosed as well as zero-day vulnerabilities for initial access, and in at least two cases re-compromised victims following remediation efforts. The goals of C0017 are unknown, however APT41 was observed exfiltrating Personal Identifiable Information (PII).

Related

Attributed to · MITRE ATT&CK (1)

Uses · MITRE ATT&CK (35)

  • T1680 Local Storage Discovery technique
  • S1052 DEADEYE software (malware)
  • S1051 KEYPLUG software (malware)
  • T1588.002 Tool sub-technique
  • T1059.007 JavaScript sub-technique
  • T1001.003 Protocol or Service Impersonation sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1102.001 Dead Drop Resolver sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1574 Hijack Execution Flow technique
  • T1059.003 Windows Command Shell sub-technique
  • T1567 Exfiltration Over Web Service technique
  • T1560.003 Archive via Custom Method sub-technique
  • T1003.002 Security Account Manager sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1027.002 Software Packing sub-technique
  • T1505.003 Web Shell sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1190 Exploit Public-Facing Application technique
  • S0154 Cobalt Strike software (malware)
  • T1134 Access Token Manipulation technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • S0002 Mimikatz software (tool)
  • S0097 Ping software (tool)
  • S0105 dsquery software (tool)
  • T1005 Data from Local System technique
  • T1016 System Network Configuration Discovery technique
  • T1027 Obfuscated Files or Information technique
Show all 35 ›

References