MITRE ATT&CKsoftware (malware)
S1132 IPsec Helper
- Domain
- enterprise
- Platforms
- Windows
- Version
- 1.0
- Created
- 2024-05-22
Description
IPsec Helper is a post-exploitation remote access tool linked to Agrius operations. This malware shares significant programming and functional overlaps with Apostle ransomware, also linked to Agrius. IPsec Helper provides basic remote access tool functionality such as uploading files from victim systems, running commands, and deploying additional payloads.
Related
Uses · MITRE ATT&CK (15)
- T1027.013 Encrypted/Encoded File sub-technique
- T1070.009 Clear Persistence sub-technique
- T1071.001 Web Protocols sub-technique
- T1570 Lateral Tool Transfer technique
- T1569.002 Service Execution sub-technique
- T1059.001 PowerShell sub-technique
- T1059.003 Windows Command Shell sub-technique
- T1059.005 Visual Basic sub-technique
- T1497.003 Time Based Checks sub-technique
- T1070.004 File Deletion sub-technique
- T1005 Data from Local System technique
- T1041 Exfiltration Over C2 Channel technique
- T1057 Process Discovery technique
- T1070 Indicator Removal technique
- T1112 Modify Registry technique
Referenced by MITRE ATT&CK · uses (1)
- G1030 Agrius group
References
- https://assets.sentinelone.com/sentinellabs/evol-agrius SentinelOne Agrius 2021