Novetta-Axiom

Axiom has used steganography to hide its C2 communications.

Zox has used the .PNG file format for C2 communications.

Axiom has been known to dump credentials.

Axiom has collected data from a compromised network.

Hikit can upload files from compromised machines.

Zox has the ability to upload files from a targeted system.

Axiom has used RDP during operations.

Zox has the ability to use SMB for communication.

Zox has been encoded with Base64.

Zox has the ability to list processes.

Zox has the ability to leverage local and remote exploits to escalate privileges.

The Derusbi malware supports timestomping.

Axiom has used previously compromised administrative accounts to escalate privileges.

Zox can enumerate files on a compromised host.

Hikit supports peer connections.

Hikit has the ability to download files to a compromised host.

Zox can download files to a compromised machine.

Axiom has been observed using SQL injection to gain access to systems.

Axiom actors have been known to use the Sticky Keys replacement within RDP sessions to obtain persistence.

Axiom has used digital certificates to deliver malware.

Axiom has compressed and encrypted data prior to exfiltration.

Axiom has targeted victims with remote administration tools including RDP.

Axiom has used spear phishing to initially compromise victims.

Hikit has been spread through spear phishing.

Hikit performs XOR encryption.

Axiom has acquired dynamic DNS services for use in the targeting of intended victims.

Axiom has used VPS hosting providers in targeting of intended victims.

Axiom has used large groups of compromised machines for use as proxy nodes.

Zox can enumerate attached drives.