Symantec Elfin Mar 2019

APT33 has used a variety of publicly available tools like LaZagne, Mimikatz, and ProcDump to dump credentials.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

APT33 has used SniffPass to collect credentials by sniffing network traffic.

APT33 has used FTP to exfiltrate files (separately from the C2 channel).

APT33 has created a scheduled task to execute a .vbe file multiple times a day.

APT33 has utilized PowerShell to download files from the C2 server and run various scripts.

APT33 has used HTTP for command and control.

APT33 has downloaded additional files and programs from its C2 server.

APT33 has attempted to exploit a known vulnerability in WinRAR (CVE-2018-20250), and attempted to gain remote code execution via a security bypass vulnerability (CVE-2017-11774).

APT33 has lured users to click links to malicious HTML applications delivered via spearphishing emails.

APT33 has deployed a tool known as DarkComet to the Startup folder of a victim, and used Registry run keys to gain persistence.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

APT33 has used a variety of publicly available tools like Gpppassword to gather credentials.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

APT33 has used a variety of publicly available tools like LaZagne to gather credentials.

APT33 has used WinRAR to compress data prior to exfil.

StoneDrill can wipe the accessible physical or logical drives of the infected machine.

StoneDrill can wipe the master boot record of an infected computer.

APT33 has sent spearphishing emails containing links to .hta files.

APT33 has used HTTP over TCP ports 808 and 880 for command and control.

APT33 has obtained and leveraged publicly-available tools for early intrusion activities.