Kaspersky Transparent Tribe August 2020

Crimson contains a command to collect the victim MAC address and LAN IP.

Crimson contains a module to collect data from removable drives.

Crimson can identify the user on a targeted system.

Transparent Tribe can mimic legitimate Windows directories by using the same icons and names.

Crimson can use a module to perform keylogging on compromised hosts.

Crimson contains a command to list processes.

Crimson has the ability to execute commands with the COMSPEC environment variable.

Transparent Tribe has crafted VBS-based malicious documents.

Crimson has the ability to delete files from a compromised host.

Crimson contains a command to collect the victim PC name and operating system.

Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.

Crimson can spread across systems by infecting removable media.

Crimson uses a custom TCP protocol for C2.

Crimson contains a command to retrieve files from its C2 server.

Crimson contains a command to perform screen captures.

Crimson has the ability to discover pluggable/removable drives to extract files from.

Crimson can perform audio surveillance using microphones.

Crimson has the ability to determine the date and time on a compromised host.

Crimson can capture webcam video on targeted systems.

Transparent Tribe has used weaponized documents in e-mail to compromise targeted systems.

Crimson contains a command to collect information about anti-virus software on the victim.

Crimson can add Registry run keys for persistence.

Crimson contains a module to steal credentials from Web browsers on the victim machine.

Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.

Transparent Tribe has sent spearphishing e-mails with attachments to deliver malicious payloads.

Crimson can identify the geographical location of a victim host.

Crimson contains a command to collect disk drive information.