MITRE ATT&CKcampaign
C0040 APT41 DUST
- Domain
- enterprise
- Version
- 1.0
- Created
- 2024-09-16
Description
APT41 DUST was conducted by APT41 from 2023 to July 2024 against entities in Europe, Asia, and the Middle East. APT41 DUST targeted sectors such as shipping, logistics, and media for information gathering purposes. APT41 used previously-observed malware such as DUSTPAN as well as newly observed tools such as DUSTTRAP in APT41 DUST.
Related
Attributed to · MITRE ATT&CK (1)
- G0096 APT41 group
Uses · MITRE ATT&CK (27)
- T1213.006 Databases sub-technique
- S1158 DUSTPAN software (malware)
- S1159 DUSTTRAP software (malware)
- T1027.013 Encrypted/Encoded File sub-technique
- T1583.007 Serverless sub-technique
- T1586.003 Cloud Accounts sub-technique
- T1593.002 Search Engines sub-technique
- T1594 Search Victim-Owned Websites technique
- T1596.005 Scan Databases sub-technique
- T1588.003 Code Signing Certificates sub-technique
- T1573.002 Asymmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1074.001 Local Data Staging sub-technique
- T1574.001 DLL sub-technique
- T1569.002 Service Execution sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1560.001 Archive via Utility sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1553.002 Code Signing sub-technique
- T1070.004 File Deletion sub-technique
- T1543.003 Windows Service sub-technique
- T1505.003 Web Shell sub-technique
- S0154 Cobalt Strike software (malware)
- S0160 certutil software (tool)
- T1102 Web Service technique
- T1105 Ingress Tool Transfer technique
- T1119 Automated Collection technique
References
- https://cloud.google.com/blog/topics/threat-intelligence/apt41-arisen-from-dust Google Cloud APT41 2024