MITRE ATT&CKsoftware (malware)
S0238 Proxysvc
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.3
- Created
- 2018-10-17
Description
Proxysvc is a malicious DLL used by Lazarus Group in a campaign known as Operation GhostSecret. It has appeared to be operating undetected since 2017 and was mostly observed in higher education organizations. The goal of Proxysvc is to deliver additional payloads to the target and to maintain control for the attacker. It is in the form of a DLL that can also be executed as a standalone process.
Related
Uses · MITRE ATT&CK (15)
- T1680 Local Storage Discovery technique
- T1071.001 Web Protocols sub-technique
- T1569.002 Service Execution sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1070.004 File Deletion sub-technique
- T1485 Data Destruction technique
- T1005 Data from Local System technique
- T1012 Query Registry technique
- T1016 System Network Configuration Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1119 Automated Collection technique
- T1124 System Time Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- G0032 Lazarus Group group