Campaign, Nov 2018 to Nov 2018.View on attack.mitre.org
C0021 was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporations in the oil and gas, chemical, and hospitality industries. The majority of targets were located in the US, particularly in and around Washington D.C., with other targets located in Europe, Hong Kong, India, and Canada. C0021's technical artifacts, tactics, techniques, and procedures (TTPs), and targeting overlap with previous suspected APT29 activity.
| Technique | Procedure example |
|---|---|
| T1027.009 Embedded Payloads |
For C0021, the threat actors embedded a base64-encoded payload within a LNK file. |
| T1027.010 Command Obfuscation |
During C0021, the threat actors used encoded PowerShell commands. |
| T1059.001 PowerShell |
During C0021, the threat actors used obfuscated PowerShell to extract an encoded payload from within an .LNK file. |
| T1071.001 Web Protocols |
During C0021, the threat actors used HTTP for some of their C2 communications. |
| T1095 Non-Application Layer Protocol |
During C0021, the threat actors used TCP for some C2 communications. |
| T1105 Ingress Tool Transfer |
During C0021, the threat actors downloaded additional tools and files onto victim machines. |
| T1140 Deobfuscate/Decode Files or Information |
During C0021, the threat actors deobfuscated encoded PowerShell commands including use of the specific string `'FromBase'+0x40+'String'`, in place of `FromBase64String` which is normally used to decode base64. |
| T1204.001 Malicious Link |
During C0021, the threat actors lured users into clicking a malicious link which led to the download of a ZIP archive containing a malicious .LNK file. |
| T1218.011 Rundll32 |
During C0021, the threat actors used `rundll32.exe` to execute the Cobalt Strike Beacon loader DLL. |
| T1566.002 Spearphishing Link |
During C0021, the threat actors sent phishing emails with unique malicious links, likely for tracking victim clicks. |
| T1573.002 Asymmetric Cryptography |
During C0021, the threat actors used SSL via TCP port 443 for C2 communications. |
| T1583.001 Domains |
For C0021, the threat actors registered domains for use in C2. |
| T1584.001 Domains |
For C0021, the threat actors used legitimate but compromised domains to host malicious payloads. |
| T1588.002 Tool |
For C0021, the threat actors used Cobalt Strike configured with a modified variation of the publicly available Pandora Malleable C2 Profile. |
| T1608.001 Upload Malware |
For C0021, the threat actors uploaded malware to websites under their control. |
MITRE does not attribute this campaign to a group.
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
