MITRE ATT&CKgroup
G1018 TA2541
- Domain
- enterprise
- Version
- 1.1
- Created
- 2023-09-12
Description
TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.
Related
Uses · MITRE ATT&CK (37)
- T1685 Disable or Modify Tools technique
- T1027.015 Compression sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- S1087 AsyncRAT software (tool)
- S1086 Snip3 software (malware)
- S0670 WarzoneRAT software (malware)
- T1016.001 Internet Connection Discovery sub-technique
- T1608.001 Upload Malware sub-technique
- T1583.006 Web Services sub-technique
- T1588.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- S0434 Imminent Monitor software (tool)
- T1573.002 Asymmetric Cryptography sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1568 Dynamic Resolution technique
- T1059.001 PowerShell sub-technique
- T1059.005 Visual Basic sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1518.001 Security Software Discovery sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1027.002 Software Packing sub-technique
- T1218.005 Mshta sub-technique
- T1547.001 Registry Run Keys / Startup Folder sub-technique
- T1055.012 Process Hollowing sub-technique
- T1053.005 Scheduled Task sub-technique
- S0385 njRAT software (malware)
- S0379 Revenge RAT software (malware)
References
- https://www.proofpoint.com/us/blog/threat-insight/charting-ta2541s-flight Proofpoint TA2541 February 2022
- https://blog.talosintelligence.com/operation-layover-how-we-tracked-attack/ Cisco Operation Layover September 2021