HTRAN

S0040

About this tool

HTRAN is a tool that proxies connections through intermediate hops and aids users in disguising their true geographical location. It can be used by adversaries to hide their location when interacting with the victim networks.

Techniques used3

Procedure examples3

Technique	Procedure example
T1014 Rootkit	HTRAN can install a rootkit to hide network connections from the host OS. NCSC Joint Report Public Tools
T1055 Process Injection	HTRAN can inject into into running processes. NCSC Joint Report Public Tools
T1090 Proxy	HTRAN can proxy TCP socket connections to obfuscate command and control infrastructure. NCSC Joint Report Public Tools Operation Quantum Entanglement

Groups that use it2

APT12 GALLIUM

Campaigns0

None recorded.

References2

NCSC Joint Report Public Tools Open source
The Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NZ NCSC), CERT New Zealand, the UK National Cyber Security Centre (UK NCSC) and the US National Cybersecurity and Communications Integration Center (NCCIC). (2018, October 11). Joint report on publicly available hacking tools. Retrieved March 11, 2019.
Operation Quantum Entanglement Open source
Haq, T., Moran, N., Vashisht, S., Scott, M. (2014, September). OPERATION QUANTUM ENTANGLEMENT. Retrieved November 17, 2024.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.