MITRE ATT&CKgroup
G0018 admin@338
- Domain
- enterprise
- Version
- 1.2
- Created
- 2017-05-31
Description
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors.
Related
Uses · MITRE ATT&CK (19)
- T1069.001 Local Groups sub-technique
- T1204.002 Malicious File sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1087.001 Local Account sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1203 Exploitation for Client Execution technique
- S0012 PoisonIvy software (malware)
- S0039 Net software (tool)
- S0042 LOWBALL software (malware)
- S0043 BUBBLEWRAP software (malware)
- S0096 Systeminfo software (tool)
- S0100 ipconfig software (tool)
- S0104 netstat software (tool)
- T1007 System Service Discovery technique
- T1016 System Network Configuration Discovery technique
- T1049 System Network Connections Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique