Mandiant APT29 Eye Spy Email Nov 22

APT29 has used the `reg save` command to save registry hives.

APT29 has used the `reg save` command to extract LSA secrets offline.

APT29 has stolen data from compromised hosts.

QUIETEXIT can attempt to connect to a second hard-coded C2 if the first hard-coded C2 address fails.

APT29 has ensured web servers in a victim environment are Internet accessible before copying tools or malware to it.

QUIETEXIT has attempted to change its name to `cron` upon startup. During incident response, QUIETEXIT samples have been identified that were renamed to blend in with other legitimate files.

APT29 has hijacked legitimate application-specific startup scripts to enable malware to execute on system startup.

APT29 has installed a run command on a compromised system to enable malware execution on system startup.

APT29 has used timestomping to alter the Standard Information timestamps on their web shells to match other files in the same directory.

QUIETEXIT can use an inverse negotiated SSH connection as part of its C2.

APT29 has gained access to a global administrator account in Azure AD and has used `Service Principal` credentials in Exchange.

reGeorg can establish an HTTP or SOCKS proxy to tunnel data in and out of a network.

QUIETEXIT can proxy traffic via SOCKS.

QUIETEXIT can establish a TCP connection as part of its initial connection to the C2.

APT29 has used a compromised global administrator account in Azure AD to backdoor a service principal with `ApplicationImpersonation` rights to start collecting emails from targeted mailboxes; APT29 has also used compromised accounts holding `ApplicationImpersonation` rights in Exchange to collect emails.

APT29 has downloaded additional tools and malware onto compromised networks.

APT29 has collected emails from targeted mailboxes within a compromised Azure AD tenant and compromised Exchange servers, including via Exchange Web Services (EWS) API requests.

APT29 has installed web shells on exploited Microsoft Exchange servers.

reGeorg is a web shell that has been installed on exposed web servers for access to victim environments.

APT29 has used Dynamic DNS providers for their malware C2 infrastructure.

reGeorg can tunnel TCP sessions including RDP, SSH, and SMB through HTTP.

APT29 has used unique malware in many of their operations.

APT29 has obtained and used a variety of tools including Mimikatz, SDelete, Tor, meek, and Cobalt Strike.