MITRE ATT&CKcampaign

C0018 C0018

Published 2023-01-17 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2023-01-17

Description

C0018 was a month-long ransomware intrusion that successfully deployed AvosLocker onto a compromised network. The unidentified actors gained initial access to the victim network through an exposed server and used a variety of open-source tools prior to executing AvosLocker.

Related

Uses · MITRE ATT&CK (25)

  • T1219.002 Remote Desktop Software sub-technique
  • T1027.010 Command Obfuscation sub-technique
  • S1053 AvosLocker software (malware)
  • S0633 Sliver software (tool)
  • T1588.002 Tool sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1571 Non-Standard Port technique
  • T1570 Lateral Tool Transfer technique
  • T1059.001 PowerShell sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1486 Data Encrypted for Impact technique
  • T1190 Exploit Public-Facing Application technique
  • S0154 Cobalt Strike software (malware)
  • S0002 Mimikatz software (tool)
  • S0097 Ping software (tool)
  • S0108 netsh software (tool)
  • T1016 System Network Configuration Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1036 Masquerading technique
  • T1046 Network Service Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1072 Software Deployment Tools technique
  • T1105 Ingress Tool Transfer technique

References