Crowdstrike GTR2020 Mar 2020

FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.

APT41 deployed rootkits on Linux systems.

OilRig has used Remote Desktop Protocol for lateral movement. The group has also used tunneling tools to tunnel RDP into the environment.

APT41 used RDP for lateral movement. APT41 used NATBypass to expose local RDP ports on compromised systems to the Internet.

APT41 has transferred implant files using Windows Admin Shares and the Server Message Block (SMB) protocol, then executes files through Windows Management Instrumentation (WMI).

APT41 used a compromised account to create a scheduled task on a system.

BabyShark has used scheduled tasks to maintain persistence.

Kimsuky has used Visual Basic to download malicious payloads. Kimsuky has also used malicious VBA macros within maldocs disguised as forms that trigger when a victim types any content into the lure. Kimsuky has also leveraged VBScript (VBS) scripts to execute temp.vbs every 19 minutes using a scheduled task to run QuasarRAT.

Turla has used multiple backdoors which communicate with a C2 server via email attachments.

OilRig has used compromised credentials to access other systems on a victim network.

APT41 used compromised credentials to log on to other systems.

Kimsuky has downloaded additional scripts, tools, and malware onto victim systems.

APT41 used certutil to download additional files. APT41 downloaded post-exploitation tools such as Cobalt Strike via command shell following initial access. APT41 has uploaded Procdump and NATBypass to a staging directory and has used these tools in follow-on activities.

Kimsuky has modified Registry settings for default file associations to enable all macros and for persistence. Kimsuky has also modified the registry entry for `HKCU:\Software\Microsoft\Windows\CurrentVersion\Run` registry key for persistence with the name WindowsSecurityCheck.

A OilRig macro has run a PowerShell command to decode file contents. OilRig has also used certutil to decode base64-encoded files on victims.

Cobalt Group has compromised legitimate web browser updates to deliver a backdoor.

APT41 used BITSAdmin to download and install payloads.

Kimsuky has used mshta.exe to run malicious scripts on the system.

APT41 has used rundll32.exe to execute a loader.

Kimsuky has used a modified TeamViewer client as a command and control channel.

OilRig has used web shells, often to maintain access to a victim network.

Kimsuky has placed scripts in the startup folder for persistence and modified the `HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce` Registry key.

APT41 has used search order hijacking to execute malicious payloads, such as Winnti for Windows. APT41 has also used legitimate executables to perform DLL side-loading of their malware.

APT41 has configured payloads to load via LD_PRELOAD.