ATT&CK ReferencesSecureworks IRON HEMLOCK Profile

Secureworks IRON HEMLOCK Profile

Secureworks CTU. (n.d.). IRON HEMLOCK. Retrieved February 22, 2022.

Techniques0

Not cited by any technique.

None recorded.

None recorded.

None recorded.

Technique	Used by	Procedure example
T1059.001 PowerShell	GroupAPT29	APT29 has used encoded PowerShell scripts uploaded to CozyCar installations to download and install SeaDuke. ESET T3 Threat Report 2021 Mandiant No Easy Breach Secureworks IRON HEMLOCK Profile Symantec Seaduke 2015
T1204.002 Malicious File	GroupAPT29	APT29 has used various forms of spearphishing attempting to get a user to open attachments, including, but not limited to, malicious Microsoft Word documents, .pdf, and .lnk files. ESET T3 Threat Report 2021 F-Secure The Dukes Secureworks IRON HEMLOCK Profile
T1566.001 Spearphishing Attachment	GroupAPT29	APT29 has used spearphishing emails with an attachment to deliver files with exploits to initial victims. ESET T3 Threat Report 2021 F-Secure The Dukes MSTIC NOBELIUM May 2021 Secureworks IRON HEMLOCK Profile
T1573 Encrypted Channel	GroupAPT29	APT29 has used multiple layers of encryption within malware to protect C2 communication. Secureworks IRON HEMLOCK Profile

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.