Threat group.View on attack.mitre.org
admin@338 is a China-based cyber threat group. It has previously used newsworthy events as lures to deliver malware and has primarily targeted organizations involved in financial, economic, and trade policy, typically using publicly available RATs such as PoisonIvy, as well as some non-public backdoors.
| Technique | Procedure example |
|---|---|
| T1007 System Service Discovery |
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to obtain information about services: |
| T1016 System Network Configuration Discovery |
admin@338 actors used the following command after exploiting a machine with LOWBALL malware to acquire information about local networks: |
| T1036.005 Match Legitimate Resource Name or Location |
admin@338 actors used the following command to rename one of their tools to a benign file name: |
| T1049 System Network Connections Discovery |
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to display network connections: |
| T1059.003 Windows Command Shell |
Following exploitation with LOWBALL malware, admin@338 actors created a file containing a list of commands to be executed on the compromised computer. |
| T1069.001 Local Groups |
admin@338 actors used the following command following exploitation of a machine with LOWBALL malware to list local groups: |
| T1082 System Information Discovery |
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about the OS: |
| T1083 File and Directory Discovery |
admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: |
| T1087.001 Local Account |
admin@338 actors used the following commands following exploitation of a machine with LOWBALL malware to enumerate user accounts: |
| T1203 Exploitation for Client Execution |
admin@338 has exploited client software vulnerabilities for execution, such as Microsoft Word CVE-2012-0158. |
| T1204.002 Malicious File |
admin@338 has attempted to get victims to launch malicious Microsoft Word attachments delivered via spearphishing emails. |
| T1566.001 Spearphishing Attachment |
admin@338 has sent emails with malicious Microsoft Office documents attached. |
None recorded.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
