ATT&CK SoftwareCadelspy

Cadelspy

S0454

Malware.View on attack.mitre.org

About this malware

Cadelspy is a backdoor that has been used by APT39.

Techniques used8

Credential Access1

T1056.001Keylogging

Discovery3

T1010Application Window Discovery T1082System Information Discovery T1120Peripheral Device Discovery

Collection5

T1056.001Keylogging T1113Screen Capture T1115Clipboard Data T1123Audio Capture T1560Archive Collected Data

Procedure examples8

Technique	Procedure example
T1010 Application Window Discovery	Cadelspy has the ability to identify open windows on the compromised host. Symantec Chafer Dec 2015
T1056.001 Keylogging	Cadelspy has the ability to log keystrokes on the compromised host. Symantec Chafer Dec 2015
T1082 System Information Discovery	Cadelspy has the ability to discover information about the compromised host. Symantec Chafer Dec 2015
T1113 Screen Capture	Cadelspy has the ability to capture screenshots and webcam photos. Symantec Chafer Dec 2015
T1115 Clipboard Data	Cadelspy has the ability to steal data from the clipboard. Symantec Chafer Dec 2015
T1120 Peripheral Device Discovery	Cadelspy has the ability to steal information about printers and the documents sent to printers. Symantec Chafer Dec 2015
T1123 Audio Capture	Cadelspy has the ability to record audio from the compromised host. Symantec Chafer Dec 2015
T1560 Archive Collected Data	Cadelspy has the ability to compress stolen data into a .cab file. Symantec Chafer Dec 2015

Groups that use it1

Campaigns0

None recorded.

References1

Symantec Chafer Dec 2015 Open source
Symantec Security Response. (2015, December 7). Iran-based attackers use back door threats to spy on Middle Eastern targets. Retrieved April 17, 2019.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.