Miller, S., et al. (2017, March 7). FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings. Retrieved March 8, 2017.
Not cited by any technique.
None recorded.
| Technique | Used by | Procedure example |
|---|---|---|
| T1059.001 PowerShell |
MalwarePOWERSOURCE | POWERSOURCE is a PowerShell backdoor. |
| T1059.003 Windows Command Shell |
MalwareTEXTMATE | TEXTMATE executes cmd.exe to provide a reverse shell to adversaries. |
| T1071.004 DNS |
MalwareTEXTMATE | TEXTMATE uses DNS TXT records for C2. |
| T1071.004 DNS |
MalwarePOWERSOURCE | POWERSOURCE uses DNS TXT records for C2. |
| T1105 Ingress Tool Transfer |
MalwarePOWERSOURCE | POWERSOURCE has been observed being used to download TEXTMATE and the Cobalt Strike Beacon payload onto victims. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
