MITRE ATT&CKsoftware (malware)

S0665 ThreatNeedle

Published 2021-11-30 Modified 2024-04-10 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.2
Created
2021-11-30

Description

ThreatNeedle is a backdoor that has been used by Lazarus Group since at least 2019 to target cryptocurrency, defense, and mobile gaming organizations. It is considered to be an advanced cluster of Lazarus Group's Manuscrypt (a.k.a. NukeSped) malware family.

Related

Uses · MITRE ATT&CK (14)

  • T1027.015 Compression sub-technique
  • T1027.013 Encrypted/Encoded File sub-technique
  • T1027.011 Fileless Storage sub-technique
  • T1204.002 Malicious File sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1543.003 Windows Service sub-technique
  • T1140 Deobfuscate/Decode Files or Information technique
  • T1005 Data from Local System technique
  • T1082 System Information Discovery technique
  • T1083 File and Directory Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1112 Modify Registry technique

Referenced by MITRE ATT&CK · uses (1)

  • G0032 Lazarus Group group

References