MITRE ATT&CKsoftware (malware)

S0688 Meteor

Published 2022-03-07 Modified 2025-04-16 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2022-03-07

Description

Meteor is a wiper that was used against Iranian government organizations, including Iranian Railways, the Ministry of Roads, and Urban Development systems, in July 2021. Meteor is likely a newer version of similar wipers called Stardust and Comet that were reportedly used by a group called "Indra" since at least 2019 against private companies in Syria.

Related

Uses · MITRE ATT&CK (20)

  • T1685 Disable or Modify Tools technique
  • T1685.005 Clear Windows Event Logs sub-technique
  • T1484.001 Group Policy Modification sub-technique
  • T1564.003 Hidden Window sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1491.001 Internal Defacement sub-technique
  • T1036.004 Masquerade Task or Service sub-technique
  • T1070.004 File Deletion sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1531 Account Access Removal technique
  • T1490 Inhibit System Recovery technique
  • T1489 Service Stop technique
  • T1485 Data Destruction technique
  • T1047 Windows Management Instrumentation technique
  • T1057 Process Discovery technique
  • T1082 System Information Discovery technique
  • T1105 Ingress Tool Transfer technique
  • T1106 Native API technique

References