MSTIC NOBELIUM Mar 2021

GoldMax has used decoy traffic to surround its malicious network traffic to avoid detection.

Sibot has queried the registry for proxy server information.

Sibot checked if the compromised system is configured to use proxies.

GoldMax retrieved a list of the system's network interface after execution.

GoldFinder performed HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request traveled through.

During the SolarWinds Compromise, APT29 used GoldFinder to perform HTTP GET requests to check internet connectivity and identify HTTP proxy servers and other redirectors that an HTTP request travels through.

Sibot has obfuscated scripts used in execution.

Sibot has installed a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot registry key.

GoldMax has written AES-encrypted and Base64-encoded configuration files to disk.

GoldMax has impersonated systems management software to avoid detection.

GoldMax has used filenames that matched the system name, and appeared as a scheduled task impersonating systems management software within the corresponding ProgramData subfolder.

Sibot has downloaded a DLL to the C:\windows\system32\drivers\ folder and renamed it with a .sys extension.

GoldMax can exfiltrate files over the existing C2 channel.

Sibot has used WMI to discover network connections and configurations. Sibot has also used the Win32_Process class to execute a malicious DLL.

Sibot has retrieved a GUID associated with a present LAN connection on a compromised machine.

Sibot has been executed via a scheduled task.

GoldMax has used scheduled tasks to maintain persistence.

GoldMax can spawn a command shell, and execute native commands.

Sibot executes commands using VBScript.

Sibot will delete an associated registry key if a certain server response is received.

Sibot will delete itself if a certain server response is received.

GoldMax has used HTTPS and HTTP GET requests with custom HTTP cookies for C2.

GoldFinder has used HTTP for C2.

Sibot communicated with its C2 server via HTTP GET requests.

During the SolarWinds Compromise, APT29 used different compromised credentials for remote access and to move laterally.

Sibot has used a legitimate compromised website to download DLLs to the victim's machine.

Sibot can download and execute a payload onto a compromised system.

GoldMax can download and execute additional files.

Sibot has modified the Registry to install a second-stage script in the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\sibot.

GoldFinder logged and stored information related to the route or hops a packet took from a compromised machine to a hardcoded C2 server, including the target C2 URL, HTTP response/status code, HTTP response headers and values, and data received from the C2 node.

GoldMax can check the current date-time value of the compromised system, comparing it to the hardcoded execution trigger and can send the current timestamp to the C2 server.

For the SolarWinds Compromise, APT29 used compromised identities to access networks via SSH, VPNs, and other remote access tools.

Sibot can decrypt data received from a C2 and save to a file.

GoldMax has decoded and decrypted the configuration file when executed.

Sibot has been executed via MSHTA application.

Sibot has executed downloaded DLLs with rundll32.exe.

GoldMax will check if it is being run in a virtualized environment by comparing the collected MAC address to c8:27:cc:c2:37:5a.

GoldMax has set an execution trigger date and time, stored as an ASCII Unix/Epoch time value.

GoldMax has RSA-encrypted its communication with the C2 server.

For the SolarWinds Compromise, APT29 acquired C2 domains, sometimes through resellers.

For the SolarWinds Compromise, APT29 compromised domains to use for C2.