MITRE ATT&CKsoftware (malware)
S1100 Ninja
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.1
- Created
- 2024-01-11
Description
Ninja is a malware developed in C++ that has been used by ToddyCat to penetrate networks and control remote systems since at least 2020. Ninja is possibly part of a post exploitation toolkit exclusively used by ToddyCat and allows multiple operators to work simultaneously on the same machine. Ninja has been used against government and military entities in Europe and Asia and observed in specific infection chains being deployed by Samurai.
Related
Uses · MITRE ATT&CK (28)
- T1680 Local Storage Discovery technique
- T1027.015 Compression sub-technique
- T1027.013 Encrypted/Encoded File sub-technique
- T1480.001 Environmental Keying sub-technique
- T1573.001 Symmetric Cryptography sub-technique
- T1001.003 Protocol or Service Impersonation sub-technique
- T1071.001 Web Protocols sub-technique
- T1090.001 Internal Proxy sub-technique
- T1090.003 Multi-hop Proxy sub-technique
- T1132.002 Non-Standard Encoding sub-technique
- T1574.001 DLL sub-technique
- T1204.002 Malicious File sub-technique
- T1566.003 Spearphishing via Service sub-technique
- T1559 Inter-Process Communication technique
- T1036.005 Match Legitimate Resource Name or Location sub-technique
- T1070.006 Timestomp sub-technique
- T1218.011 Rundll32 sub-technique
- T1543.003 Windows Service sub-technique
- T1140 Deobfuscate/Decode Files or Information technique
- T1001 Data Obfuscation technique
- T1016 System Network Configuration Discovery technique
- T1029 Scheduled Transfer technique
- T1055 Process Injection technique
- T1057 Process Discovery technique
- T1082 System Information Discovery technique
- T1083 File and Directory Discovery technique
- T1095 Non-Application Layer Protocol technique
- T1106 Native API technique
Referenced by MITRE ATT&CK · uses (1)
- G1022 ToddyCat group
References
- https://securelist.com/toddycat/106799/ Kaspersky ToddyCat June 2022