Mandiant APT42-untangling

TAMECAT has used Windows Management Instrumentation (WMI) to query anti-virus products.

APT42 has used Windows Management Instrumentation (WMI) to query anti-virus products.

APT42 has used credential harvesting websites.

NICECURL has provided an arbitrary command execution interface.

TAMECAT has used PowerShell to download and run additional content.

TAMECAT has used `cmd.exe` to run the `curl` command.

TAMECAT has used VBScript to query anti-virus products.

APT42 has used a VBScript to query anti-virus products.

APT42 has cleared Chrome browser history.

NICECURL has a function to remove artifacts.

TAMECAT has used HTTP for C2 communications.

NICECURL has used HTTPS for C2 communications.

APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.

APT42 has used various links, such as links with typo-squatted domains, links to Dropbox files and links to fake Google sites, in spearphishing operations.

TAMECAT has used `wget` and `curl` to download additional content.

NICECURL has the ability to download additional content onto an infected machine, e.g. by using `curl`.

APT42 has intercepted SMS-based one-time passwords and has set up two-factor authentication. Additionally, APT42 has used cloned or fake websites to capture MFA tokens.

TAMECAT has encoded C2 traffic with Base64.

APT42 has encoded C2 traffic with Base64.

TAMECAT has used Windows Management Instrumentation (WMI) to check for anti-virus products.

APT42 has used Windows Management Instrumentation (WMI) to check for anti-virus products.

APT42 has collected data from Microsoft 365 environments.

APT42 has sent spearphishing emails containing malicious links.

TAMECAT has used AES to encrypt C2 traffic.

NICECURL has used HTTPS for C2 communications.

APT42 has used tools such as NICECURL with command and control communication taking place over HTTPS.

APT42 has used anonymized infrastructure and Virtual Private Servers (VPSs) to interact with the victim’s environment.

APT42 has used built-in features in the Microsoft 365 environment and publicly available tools to avoid detection.