Dell TG-3390

Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.

Threat Group-3390 actors use NBTscan to discover vulnerable systems.

HTTPBrowser's code may be obfuscated through structured exception handling and return-oriented programming.

Threat Group-3390 actors have split RAR files for exfiltration into parts.

OwaAuth uses the filename owaauth.dll, which is a legitimate file that normally resides in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\Auth\; the malicious file by the same name is saved in %ProgramFiles%\Microsoft\Exchange Server\ClientAccess\Owa\bin\.

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.

Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.

OwaAuth captures and DES-encrypts credentials before writing the username and password to a log file, C:\log.txt.

HTTPBrowser is capable of capturing keystrokes on victims.

HTTPBrowser is capable of spawning a reverse shell on a victim.

PlugX allows actors to spawn a reverse shell on a victim.

OwaAuth has a command to timestop a file or directory.

PlugX can be configured to use HTTP for command and control. PlugX has also used HTTPS for C2.

OwaAuth uses incoming HTTP requests with a username keyword and commands and handles them as instructions to perform actions.

HTTPBrowser has used HTTP and HTTPS for command and control.

HTTPBrowser has used DNS for command and control.

PlugX can be configured to use DNS for command and control.

Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.

HTTPBrowser is capable of listing files, folders, and drives on a victim.

OwaAuth has a command to list its directory and logical drives.

PlugX can be configured to use raw TCP or UDP for command and control.

Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .

HTTPBrowser is capable of writing a file to the compromised system from the C2 server.

Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services. Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.

Threat Group-3390 has extensively used strategic web compromises to target victims.

OwaAuth is a Web shell that appears to be exclusively used by Threat Group-3390. It is installed as an ISAPI filter on Exchange servers and shares characteristics with the China Chopper Web shell.

ASPXSpy is a Web shell. The ASPXTool version used by Threat Group-3390 has been deployed to accessible servers running Internet Information Services (IIS).

OwaAuth has been loaded onto Exchange servers and disguised as an ISAPI filter (owaauth.dll). The IIS w3wp.exe process then loads the malicious DLL.

OwaAuth DES-encrypts captured credentials using the key 12345678 before writing the credentials to a log file.

Threat Group-3390 has performed DLL search order hijacking to execute their payload. Threat Group-3390 has also used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as `rc.exe`, a legitimate Microsoft Resource Compiler.

PlugX has the ability to use DLL search order hijacking for installation on targeted systems. PlugX has also used DLL side-loading to evade anti-virus. PlugX has also used a legitimately signed executable to side-load a malicious payload within a DLL file.

HTTPBrowser abuses the Windows DLL load order by using a legitimate Symantec anti-virus binary, VPDN_LU.exe, to load a malicious DLL that mimics a legitimate Symantec DLL, navlu.dll. HTTPBrowser has also used DLL side-loading.

Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.

Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.