CISA AA20-239A BeagleBoyz August 2020

APT38 has collected data from a compromised host.

APT38 has identified primary users, currently logged in users, sets of users that commonly use a system, or inactive users.

APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence. Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.

APT38 has used PowerShell to execute commands and other operational tasks.

APT38 has used VBScript to execute commands and other operational tasks.

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.

APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.

APT38 has attempted to get detailed information about a compromised host, including the operating system, version, patches, hotfixes, and service packs.

APT38 have enumerated files and directories, or searched in specific locations within a compromised host.

APT38 has used the Windows API to execute code within a victim's system.

APT38 has used brute force techniques to attempt account access when passwords are unknown or when password hashes are unavailable.

APT38 has enumerated network shares on a compromised host.

APT38 has conducted watering holes schemes to gain initial access to victims.

APT38 has attempted to lure victims into enabling malicious macros within email attachments. Additionally, APT38 has used malicious Word documents and shortcut files.

APT38 has collected browser bookmark information to learn more about compromised hosts, obtain personal information about users, and acquire details about internal network resources.

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.

APT38 has used web shells for persistence or to ensure redundant access.

APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.

APT38 has installed a new Windows service to establish persistence.

APT38 has conducted spearphishing campaigns using malicious email attachments.

APT38 has created new services or modified existing ones to run executables, commands, or scripts.

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.

APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.