FireEye APT39 Jan 2019

APT39 has used Mimikatz, Windows Credential Editor and ProcDump to dump credentials.

APT39 has used NBTscan and custom tools to discover remote systems.

APT39 has been seen using RDP for lateral movement and persistence, in some cases employing the rdpwinst tool for mangement of multiple sessions.

APT39 used secure shell (SSH) to move laterally among their targets.

APT39 has packed tools with UPX, and has repacked a modified version of Mimikatz to thwart anti-virus detection.

APT39 has used CrackMapExec and a custom port scanner known as BLUETORCH for network scanning.

APT39 has created scheduled tasks for persistence.

APT39 has utilized custom scripts to perform internal reconnaissance.

APT39 has used stolen credentials to compromise Outlook Web Access (OWA).

APT39 used custom tools to create SOCK5 and custom protocol proxies between infected hosts.

APT39 has used Ncrack to reveal credentials.

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious link.

APT39 has sent spearphishing emails in an attempt to lure users to click on a malicious attachment.

APT39 has installed ANTAK and ASPXSPY web shells.

APT39 has maintained persistence using the startup folder.

APT39 has modified LNK shortcuts.

APT39 has used WinRAR and 7-Zip to compress an archive stolen data.

APT39 leveraged spearphishing emails with malicious attachments to initially compromise victims.

APT39 leveraged spearphishing emails with malicious links to initially compromise victims.