MITRE ATT&CKcampaign

C0023 Operation Ghost

Published 2023-03-23 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2023-03-23

Description

Operation Ghost was an APT29 campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. embassy of a European Union country. During Operation Ghost, APT29 used new families of malware and leveraged web services, steganography, and unique C2 infrastructure for each victim.

Related

Attributed to · MITRE ATT&CK (1)

Uses · MITRE ATT&CK (13)

  • T1585.001 Social Media Accounts sub-technique
  • T1587.001 Malware sub-technique
  • T1583.001 Domains sub-technique
  • S0512 FatDuke software (malware)
  • S0511 RegDuke software (malware)
  • S0518 PolyglotDuke software (malware)
  • T1001.002 Steganography sub-technique
  • T1102.002 Bidirectional Communication sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1027.003 Steganography sub-technique
  • T1546.003 Windows Management Instrumentation Event Subscription sub-technique
  • S0029 PsExec software (tool)
  • S0051 MiniDuke software (malware)

References