ATT&CK SoftwareBISCUIT

BISCUIT

S0017

Malware.View on attack.mitre.org

About this malware

BISCUIT is a backdoor that has been used by APT1 since as early as 2007.

Techniques used10

Execution1

T1059.003Windows Command Shell

Credential Access1

T1056.001Keylogging

Discovery4

T1033System Owner/User Discovery T1057Process Discovery T1082System Information Discovery T1124System Time Discovery

Collection2

T1056.001Keylogging T1113Screen Capture

Command and Control3

T1008Fallback Channels T1105Ingress Tool Transfer T1573.002Asymmetric Cryptography

Procedure examples10

Technique	Procedure example
T1008 Fallback Channels	BISCUIT malware contains a secondary fallback command and control server that is contacted after the primary command and control server. Mandiant APT1 Mandiant APT1 Appendix
T1033 System Owner/User Discovery	BISCUIT has a command to gather the username from the system. Mandiant APT1 Appendix
T1056.001 Keylogging	BISCUIT can capture keystrokes. Mandiant APT1 Appendix
T1057 Process Discovery	BISCUIT has a command to enumerate running processes and identify their owners. Mandiant APT1 Appendix
T1059.003 Windows Command Shell	BISCUIT has a command to launch a command shell on the system. Mandiant APT1 Appendix
T1082 System Information Discovery	BISCUIT has a command to collect the processor type, operation system, computer name, and whether the system is a laptop or PC. Mandiant APT1
T1105 Ingress Tool Transfer	BISCUIT has a command to download a file from the C2 server. Mandiant APT1 Appendix
T1113 Screen Capture	BISCUIT has a command to periodically take screenshots of the system. Mandiant APT1 Appendix
T1124 System Time Discovery	BISCUIT has a command to collect the system `UPTIME`. Mandiant APT1
T1573.002 Asymmetric Cryptography	BISCUIT uses SSL for encrypting C2 communications. Mandiant APT1 Appendix

Groups that use it1

Campaigns0

None recorded.

References1

Mandiant APT1 Open source
Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.