MITRE ATT&CKgroup
G0026 APT18
- Domain
- enterprise
- Aliases
- TG-0416, Dynamite Panda, Threat Group-0416
- Version
- 2.2
- Created
- 2017-05-31
Description
APT18 is a threat group that has operated since at least 2009 and has targeted a range of industries, including technology, manufacturing, human rights groups, government, and medical.
Related
Uses · MITRE ATT&CK (17)
- T1027.013 Encrypted/Encoded File sub-technique
- T1071.001 Web Protocols sub-technique
- T1071.004 DNS sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1070.004 File Deletion sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1053.002 At sub-technique
- S0032 gh0st RAT software (malware)
- S0070 HTTPBrowser software (malware)
- S0071 hcdLoader software (malware)
- S0106 cmd software (tool)
- S0124 Pisloader software (malware)
- T1078 Valid Accounts technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
- T1133 External Remote Services technique
References
- http://www.secureworks.com/resources/blog/where-you-at-indicators-of-lateral-movement-using-at-exe-on-windows-7-systems/ Dell Lateral Movement
- https://www.anomali.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop Anomali Evasive Maneuvers July 2015
- https://www.threatstream.com/blog/evasive-maneuvers-the-wekby-group-attempts-to-evade-analysis-via-custom-rop ThreatStream Evasion Analysis