ATT&CK ReferencesFireEye Ryuk and Trickbot January 2019

FireEye Ryuk and Trickbot January 2019

Goody, K., et al (2019, January 11). A Nasty Trick: From Credential Theft Malware to Business Disruption. Retrieved May 12, 2020.

Open the source

Techniques0

Not cited by any technique.

Groups0

None recorded.

Software2

AdFind Ryuk

Campaigns0

None recorded.

Procedure examples8

Technique	Used by	Procedure example
T1016 System Network Configuration Discovery	ToolAdFind	AdFind can extract subnet information from Active Directory. FireEye FIN6 Apr 2019 FireEye Ryuk and Trickbot January 2019 Red Canary Hospital Thwarted Ryuk October 2020
T1018 Remote System Discovery	ToolAdFind	AdFind has the ability to query Active Directory for computers. Cybereason Bumblebee August 2022 FireEye FIN6 Apr 2019 FireEye Ryuk and Trickbot January 2019 Red Canary Hospital Thwarted Ryuk October 2020
T1018 Remote System Discovery	GroupWizard Spider	Wizard Spider has used networkdll for network discovery and psfin specifically for financial and point of sale indicators. Wizard Spider has also used AdFind, `nltest/dclist`, and PowerShell script Get-DataInfo.ps1 to enumerate domain computers, including the domain controller. CrowdStrike Grim Spider May 2019 DFIR Ryuk's Return October 2020 FireEye KEGTAP SINGLEMALT October 2020 FireEye Ryuk and Trickbot January 2019 Mandiant FIN12 Oct 2021 Red Canary Hospital Thwarted Ryuk October 2020
T1027.010 Command Obfuscation	GroupWizard Spider	Wizard Spider used Base64 encoding to obfuscate an Empire service and PowerShell commands. DFIR Ryuk's Return October 2020 FireEye Ryuk and Trickbot January 2019
T1069.002 Domain Groups	ToolAdFind	AdFind can enumerate domain groups. FireEye FIN6 Apr 2019 FireEye Ryuk and Trickbot January 2019 Red Canary Hospital Thwarted Ryuk October 2020 Symantec Bumblebee June 2022
T1087.002 Domain Account	ToolAdFind	AdFind can enumerate domain users. Cybereason Bumblebee August 2022 FireEye FIN6 Apr 2019 FireEye Ryuk and Trickbot January 2019 Red Canary Hospital Thwarted Ryuk October 2020 Symantec Bumblebee June 2022
T1482 Domain Trust Discovery	ToolAdFind	AdFind can gather information about organizational units (OUs) and domain trusts from Active Directory. FireEye FIN6 Apr 2019 FireEye Ryuk and Trickbot January 2019 Red Canary Hospital Thwarted Ryuk October 2020 Symantec Bumblebee June 2022
T1685 Disable or Modify Tools	MalwareRyuk	Ryuk has stopped services related to anti-virus. FireEye Ryuk and Trickbot January 2019

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.