MITRE ATT&CKsoftware (malware)

S0487 Kessel

Published 2020-07-16 Modified 2024-04-11 Official page ↗
Domain
enterprise
Platforms
Linux
Version
1.1
Created
2020-07-16

Description

Kessel is an advanced version of OpenSSH which acts as a custom backdoor, mainly acting to steal credentials and function as a bot. Kessel has been active since its C2 domain began resolving in August 2018.

Related

Uses · MITRE ATT&CK (14)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1132.001 Standard Encoding sub-technique
  • T1560 Archive Collected Data technique
  • T1554 Compromise Host Software Binary technique
  • T1556 Modify Authentication Process technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1016 System Network Configuration Discovery technique
  • T1030 Data Transfer Size Limits technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1059 Command and Scripting Interpreter technique
  • T1082 System Information Discovery technique
  • T1090 Proxy technique
  • T1105 Ingress Tool Transfer technique

References