MITRE ATT&CKsoftware (malware)

S0464 SYSCON

Published 2020-06-02 Modified 2025-04-16 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.1
Created: 2020-06-02

Description

SYSCON is a backdoor that has been in use since at least 2017 and has been associated with campaigns involving North Korean themes. SYSCON has been delivered by the CARROTBALL and CARROTBAT droppers.

Uses · MITRE ATT&CK (5)

T1071.002 File Transfer Protocols sub-technique
T1204.002 Malicious File sub-technique
T1059.003 Windows Command Shell sub-technique
T1057 Process Discovery technique
T1082 System Information Discovery technique

Referenced by MITRE ATT&CK · uses (1)

C0006 Operation Honeybee campaign

References

https://unit42.paloaltonetworks.com/unit42-the-fractured-block-campaign-carrotbat-malware-used-to-deliver-malware-targeting-southeast-asia/ Unit 42 CARROTBAT November 2018
https://unit42.paloaltonetworks.com/the-fractured-statue-campaign-u-s-government-targeted-in-spear-phishing-attacks/ Unit 42 CARROTBAT January 2020

S0464 SYSCON

Description

Related

Uses · MITRE ATT&CK (5)

Referenced by MITRE ATT&CK · uses (1)

References