MITRE ATT&CKsoftware (malware)

S0241 RATANKBA

Published 2018-10-17 Modified 2025-04-25 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2018-10-17

Description

RATANKBA is a remote controller tool used by Lazarus Group. RATANKBA has been used in attacks targeting financial institutions in Poland, Mexico, Uruguay, the United Kingdom, and Chile. It was also seen used against organizations related to telecommunications, management consulting, information technology, insurance, aviation, and education. RATANKBA has a graphical user interface to allow the attacker to issue jobs to perform on the infected machines.

Related

Uses · MITRE ATT&CK (15)

  • T1071.001 Web Protocols sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1087.001 Local Account sub-technique
  • T1055.001 Dynamic-link Library Injection sub-technique
  • T1007 System Service Discovery technique
  • T1012 Query Registry technique
  • T1016 System Network Configuration Discovery technique
  • T1018 Remote System Discovery technique
  • T1033 System Owner/User Discovery technique
  • T1047 Windows Management Instrumentation technique
  • T1049 System Network Connections Discovery technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

  • G0032 Lazarus Group group

References