SecureWorks BRONZE UNION June 2017

Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.

Threat Group-3390 has used WinRM to enable remote execution.

Threat Group-3390 has used `net use` and `netstat` to conduct internal discovery of systems. The group has also used `quser.exe` to identify existing RDP sessions on a victim.

Threat Group-3390 has used PowerShell for execution.

Threat Group-3390 has used command-line interfaces for execution.

China Chopper's server component is capable of opening a command terminal.

Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.

Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.

Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.

Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.

Threat Group-3390 has used net user to conduct internal discovery of systems.

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.

Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services. Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.

Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.

Threat Group-3390 has performed DLL search order hijacking to execute their payload. Threat Group-3390 has also used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as `rc.exe`, a legitimate Microsoft Resource Compiler.

Threat Group-3390 has used appcmd.exe to disable logging on a victim server.