Cisco Operation Layover September 2021

TA2541 has run scripts to check internet connectivity from compromised hosts.

TA2541 has used a .NET packer to obfuscate malicious files.

TA2541 has used compressed and char-encoded scripts in operations.

TA2541 has used compressed and char-encoded scripts in operations.

TA2541 has injected malicious code into legitimate .NET related processes including regsvcs.exe, msbuild.exe, and installutil.exe.

TA2541 has used process hollowing to execute CyberGate malware.

TA2541 has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.

TA2541 has used malicious scripts and macros with the ability to download additional payloads.

TA2541 has used macro-enabled MS Word documents to lure victims into executing malicious payloads.

TA2541 has used `mshta` to execute scripts including VBS.

TA2541 has sent phishing emails with malicious attachments for initial access including MS Word documents.

TA2541 has used TLS encrypted C2 communications including for campaigns using AsyncRAT.

TA2541 has registered domains often containing the keywords “kimjoy,” “h0pe,” and “grace,” using domain registrars including Netdorm and No-IP DDNS, and hosting providers including xTom GmbH and Danilenko, Artyom.

TA2541 has used commodity remote access tools.

TA2541 has uploaded malware to various platforms including Google Drive, Pastetext, Sharetext, and GitHub.