MITRE ATT&CKsoftware (malware)

S0661 FoggyWeb

Published 2021-11-16 Modified 2024-04-11 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.1
Created
2021-11-16

Description

FoggyWeb is a passive and highly-targeted backdoor capable of remotely exfiltrating sensitive information from a compromised Active Directory Federated Services (AD FS) server. It has been used by APT29 since at least early April 2021.

Related

Uses · MITRE ATT&CK (21)

  • T1027.013 Encrypted/Encoded File sub-technique
  • T1620 Reflective Code Loading technique
  • T1027.004 Compile After Delivery sub-technique
  • T1573.001 Symmetric Cryptography sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1574.001 DLL sub-technique
  • T1560.002 Archive via Library sub-technique
  • T1560.003 Archive via Custom Method sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1552.004 Private Keys sub-technique
  • T1550 Use Alternate Authentication Material technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1036 Masquerading technique
  • T1040 Network Sniffing technique
  • T1041 Exfiltration Over C2 Channel technique
  • T1057 Process Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique
  • T1129 Shared Modules technique

Referenced by MITRE ATT&CK · uses (1)

References