MITRE ATT&CKcampaign
C0037 Water Curupira Pikabot Distribution
- Domain
- enterprise
- Version
- 1.0
- Created
- 2024-07-17
Description
Pikabot was distributed in Water Curupira Pikabot Distribution throughout 2023 by an entity linked to BlackBasta ransomware deployment via email attachments. This activity followed the take-down of QakBot, with several technical overlaps and similarities with QakBot, indicating a possible connection. The identified activity led to the deployment of tools such as Cobalt Strike, while coinciding with campaigns delivering DarkGate and IcedID en route to ransomware deployment.
Related
Uses · MITRE ATT&CK (13)
- S1145 Pikabot software (malware)
- S1111 DarkGate software (malware)
- T1589.002 Email Addresses sub-technique
- S0483 IcedID software (malware)
- T1059.007 JavaScript sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1218.011 Rundll32 sub-technique
- T1204 User Execution technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1105 Ingress Tool Transfer technique
References
- https://www.trendmicro.com/en_us/research/24/a/a-look-into-pikabot-spam-wave-campaign.html TrendMicro Pikabot 2024