MITRE ATT&CKsoftware (malware)

S0093 Backdoor.Oldrea

Published 2017-05-31 Modified 2025-04-16 Official page ↗
Domain
enterprise, ics
Platforms
Windows
Aliases
Havex
Version
2.0
Created
2017-05-31

Description

Backdoor.Oldrea is a modular backdoor that used by Dragonfly against energy companies since at least 2013. Backdoor.Oldrea was distributed via supply chain compromise, and included specialized modules to enumerate and map ICS-specific systems, processes, and protocols.

Related

Uses · MITRE ATT&CK (24)

  • T0888 Remote System Information Discovery technique
  • T0802 Automated Collection technique
  • T0814 Denial of Service technique
  • T0846 Remote System Discovery technique
  • T0861 Point & Tag Identification technique
  • T0862 Supply Chain Compromise technique
  • T0863 User Execution technique
  • T0865 Spearphishing Attachment technique
  • T1132.001 Standard Encoding sub-technique
  • T1087.003 Email Account sub-technique
  • T1560 Archive Collected Data technique
  • T1555.003 Credentials from Web Browsers sub-technique
  • T1070.004 File Deletion sub-technique
  • T1218.011 Rundll32 sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1016 System Network Configuration Discovery technique
  • T1018 Remote System Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1046 Network Service Discovery technique
  • T1055 Process Injection technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

References