MITRE ATT&CKcampaign
C0026 C0026
- Domain
- enterprise
- Version
- 1.0
- Created
- 2023-05-15
Description
C0026 was a campaign identified in September 2022 that included the selective distribution of KOPILUWAK and QUIETCANARY malware to previous ANDROMEDA malware victims in Ukraine through re-registered ANDROMEDA C2 domains. Several tools and tactics used during C0026 were consistent with historic Turla operations.
Related
Uses · MITRE ATT&CK (12)
- S1076 QUIETCANARY software (malware)
- S1075 KOPILUWAK software (malware)
- S1074 ANDROMEDA software (malware)
- T1583.001 Domains sub-technique
- T1568 Dynamic Resolution technique
- T1560.001 Archive via Utility sub-technique
- S0039 Net software (tool)
- S0099 Arp software (tool)
- S0104 netstat software (tool)
- T1005 Data from Local System technique
- T1030 Data Transfer Size Limits technique
- T1105 Ingress Tool Transfer technique
References
- https://www.mandiant.com/resources/blog/turla-galaxy-opportunity Mandiant Suspected Turla Campaign February 2023