MITRE ATT&CKcampaign
C0021 C0021
- Domain
- enterprise
- Version
- 1.0
- Created
- 2023-03-15
Description
C0021 was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporations in the oil and gas, chemical, and hospitality industries. The majority of targets were located in the US, particularly in and around Washington D.C., with other targets located in Europe, Hong Kong, India, and Canada. C0021's technical artifacts, tactics, techniques, and procedures (TTPs), and targeting overlap with previous suspected APT29 activity.
Related
Uses · MITRE ATT&CK (16)
- T1027.010 Command Obfuscation sub-technique
- T1027.009 Embedded Payloads sub-technique
- T1608.001 Upload Malware sub-technique
- T1584.001 Domains sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1204.001 Malicious Link sub-technique
- T1059.001 PowerShell sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1218.011 Rundll32 sub-technique
- S0154 Cobalt Strike software (malware)
- T1140 Deobfuscate/Decode Files or Information technique
- T1095 Non-Application Layer Protocol technique
- T1105 Ingress Tool Transfer technique
References
- https://www.fireeye.com/blog/threat-research/2018/11/not-so-cozy-an-uncomfortable-examination-of-a-suspected-apt29-phishing-campaign.html FireEye APT29 Nov 2018
- https://www.microsoft.com/security/blog/2018/12/03/analysis-of-cyberattack-on-u-s-think-tanks-non-profits-public-sector-by-unidentified-attackers/ Microsoft Unidentified Dec 2018