MITRE ATT&CKsoftware (malware)
S1023 CreepyDrive
- Domain
- enterprise
- Platforms
- Windows, Office Suite
- Version
- 1.0
- Created
- 2022-07-07
Description
CreepyDrive is a custom implant has been used by POLONIUM since at least early 2022 for C2 with and exfiltration to actor-controlled OneDrive accounts.
POLONIUM has used a similar implant called CreepyBox that relies on actor-controlled DropBox accounts.
Related
Uses · MITRE ATT&CK (8)
- T1071.001 Web Protocols sub-technique
- T1102.002 Bidirectional Communication sub-technique
- T1059.001 PowerShell sub-technique
- T1567.002 Exfiltration to Cloud Storage sub-technique
- T1550.001 Application Access Token sub-technique
- T1005 Data from Local System technique
- T1083 File and Directory Discovery technique
- T1105 Ingress Tool Transfer technique
Referenced by MITRE ATT&CK · uses (1)
- G1005 POLONIUM group