ATT&CK SoftwareCreepySnail

CreepySnail

S1024

Malware.View on attack.mitre.org

About this malware

CreepySnail is a custom PowerShell implant that has been used by POLONIUM since at least 2022.

Techniques used7

Initial Access1

T1078.002Domain Accounts

Execution1

T1059.001PowerShell

Persistence1

T1078.002Domain Accounts

Privilege Escalation1

T1078.002Domain Accounts

Stealth1

T1078.002Domain Accounts

Discovery2

T1016System Network Configuration Discovery T1033System Owner/User Discovery

Command and Control2

T1071.001Web Protocols T1132.001Standard Encoding

Exfiltration1

T1041Exfiltration Over C2 Channel

Procedure examples7

Technique	Procedure example
T1016 System Network Configuration Discovery	CreepySnail can use `getmac` and `Get-NetIPAddress` to enumerate network settings. Microsoft POLONIUM June 2022
T1033 System Owner/User Discovery	CreepySnail can execute `getUsername` on compromised systems. Microsoft POLONIUM June 2022
T1041 Exfiltration Over C2 Channel	CreepySnail can connect to C2 for data exfiltration. Microsoft POLONIUM June 2022
T1059.001 PowerShell	CreepySnail can use PowerShell for execution, including the cmdlets `Invoke-WebRequst` and `Invoke-Expression`. Microsoft POLONIUM June 2022
T1071.001 Web Protocols	CreepySnail can use HTTP for C2. Microsoft POLONIUM June 2022
T1078.002 Domain Accounts	CreepySnail can use stolen credentials to authenticate on target networks. Microsoft POLONIUM June 2022
T1132.001 Standard Encoding	CreepySnail can use Base64 to encode its C2 traffic. Microsoft POLONIUM June 2022

Groups that use it1

Campaigns0

None recorded.

References1

Microsoft POLONIUM June 2022 Open source
Microsoft. (2022, June 2). Exposing POLONIUM activity and infrastructure targeting Israeli organizations. Retrieved July 1, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.