MITRE ATT&CKsoftware (malware)

S1074 ANDROMEDA

Published 2023-05-16 Modified 2023-09-29 Official page ↗
Domain
enterprise
Platforms
Windows
Version
1.0
Created
2023-05-16

Description

ANDROMEDA is commodity malware that was widespread in the early 2010's and continues to be observed in infections across a wide variety of industries. During the 2022 C0026 campaign, threat actors re-registered expired ANDROMEDA C2 domains to spread malware to select targets in Ukraine.

Related

Uses · MITRE ATT&CK (7)

  • T1036.008 Masquerade File Type sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1036.005 Match Legitimate Resource Name or Location sub-technique
  • T1547.001 Registry Run Keys / Startup Folder sub-technique
  • T1055 Process Injection technique
  • T1091 Replication Through Removable Media technique
  • T1105 Ingress Tool Transfer technique

Referenced by MITRE ATT&CK · uses (1)

References