Check Point APT34 April 2021

SideTwist can embed C2 responses in the source code of a fake Flickr webpage.

SideTwist has the ability to upload files from a compromised host.

SideTwist has primarily used port 443 for C2 but can use port 80 as a fallback.

SideTwist has the ability to collect the domain name on a compromised host.

SideTwist can collect the username on a targeted system.

OilRig has run whoami on a victim.

OilRig has used .doc file extensions to mask malicious executables.

SideTwist has exfiltrated data over its C2 channel.

OilRig has created scheduled tasks that run a VBScript to execute a payload on victim machines.

SideTwist can execute shell commands on a compromised host.

OilRig has used VBScript macros for execution on compromised hosts.

SideTwist has used HTTP GET and POST requests over port 443 for C2.

OilRig has used DNS for C2 including the publicly available requestbin.net tunneling service.

SideTwist can collect the computer name of a targeted system.

OilRig has run hostname and systeminfo on a victim.

SideTwist has the ability to search for specific files.

SideTwist has the ability to download additional files.

SideTwist can use GetUserNameW, GetComputerNameW, and GetComputerNameExW to gather information.

OilRig has used tools to identify if a mouse is connected to a targeted system.

SideTwist has used Base64 for encoded C2 traffic.

SideTwist can decode and decrypt messages received from C2.

OilRig has delivered macro-enabled documents that required targets to click the "enable content" button to execute the payload on the system.

OilRig has used macros to verify if a mouse is connected to a compromised machine.

SideTwist can encrypt C2 communications with a randomly generated key.