MITRE ATT&CKsoftware (malware)
S1042 SUGARDUMP
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2022-09-21
Description
SUGARDUMP is a proprietary browser credential harvesting tool that was used by UNC3890 during the C0010 campaign. The first known SUGARDUMP version was used since at least early 2021, a second SMTP C2 version was used from late 2021-early 2022, and a third HTTP C2 variant was used since at least April 2022.
Related
Uses · MITRE ATT&CK (13)
- T1071.001 Web Protocols sub-technique
- T1071.003 Mail Protocols sub-technique
- T1074.001 Local Data Staging sub-technique
- T1204.002 Malicious File sub-technique
- T1560.003 Archive via Custom Method sub-technique
- T1555.003 Credentials from Web Browsers sub-technique
- T1036.004 Masquerade Task or Service sub-technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1053.005 Scheduled Task sub-technique
- T1518 Software Discovery technique
- T1217 Browser Information Discovery technique
- T1041 Exfiltration Over C2 Channel technique
- T1083 File and Directory Discovery technique
Referenced by MITRE ATT&CK · uses (1)
- C0010 C0010 campaign
References
- https://www.mandiant.com/resources/blog/suspected-iranian-actor-targeting-israeli-shipping Mandiant UNC3890 Aug 2022