MITRE ATT&CKsoftware (malware)
S1031 PingPull
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2022-08-09
Description
PingPull is a remote access Trojan (RAT) written in Visual C++ that has been used by GALLIUM since at least June 2022. PingPull has been used to target telecommunications companies, financial institutions, and government entities in Afghanistan, Australia, Belgium, Cambodia, Malaysia, Mozambique, the Philippines, Russia, and Vietnam.
Related
Uses · MITRE ATT&CK (15)
- T1573.001 Symmetric Cryptography sub-technique
- T1071.001 Web Protocols sub-technique
- T1132.001 Standard Encoding sub-technique
- T1571 Non-Standard Port technique
- T1059.003 Windows Command Shell sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1070.006 Timestomp sub-technique
- T1543.003 Windows Service sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1005 Data from Local System technique
- T1016 System Network Configuration Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1095 Non-Application Layer Protocol technique
Referenced by MITRE ATT&CK · uses (1)
- G0093 GALLIUM group
References
- https://unit42.paloaltonetworks.com/pingpull-gallium/ Unit 42 PingPull Jun 2022