ATT&CK SoftwareQuietSieve

QuietSieve

S0686

Malware.View on attack.mitre.org

About this malware

QuietSieve is an information stealer that has been used by Gamaredon Group since at least 2021.

Techniques used9

Stealth1

T1564.003Hidden Window

Discovery4

T1016.001Internet Connection Discovery T1083File and Directory Discovery T1120Peripheral Device Discovery T1135Network Share Discovery

Collection2

T1005Data from Local System T1113Screen Capture

Command and Control2

T1071.001Web Protocols T1105Ingress Tool Transfer

Procedure examples9

Technique	Procedure example
T1005 Data from Local System	QuietSieve can collect files from a compromised host. Microsoft Actinium February 2022
T1016.001 Internet Connection Discovery	QuietSieve can check C2 connectivity with a `ping` to 8.8.8.8 (Google public DNS). Microsoft Actinium February 2022
T1071.001 Web Protocols	QuietSieve can use HTTPS in C2 communications. Microsoft Actinium February 2022
T1083 File and Directory Discovery	QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z. Microsoft Actinium February 2022
T1105 Ingress Tool Transfer	QuietSieve can download and execute payloads on a target host. Microsoft Actinium February 2022
T1113 Screen Capture	QuietSieve has taken screenshots every five minutes and saved them to the user's local Application Data folder under `Temp\SymbolSourceSymbols\icons` or `Temp\ModeAuto\icons`. Microsoft Actinium February 2022
T1120 Peripheral Device Discovery	QuietSieve can identify and search removable drives for specific file name extensions. Microsoft Actinium February 2022
T1135 Network Share Discovery	QuietSieve can identify and search networked drives for specific file name extensions. Microsoft Actinium February 2022
T1564.003 Hidden Window	QuietSieve has the ability to execute payloads in a hidden window. Microsoft Actinium February 2022

Groups that use it1

Gamaredon Group

Campaigns0

None recorded.

References1

Microsoft Actinium February 2022 Open source
Microsoft Threat Intelligence Center. (2022, February 4). ACTINIUM targets Ukrainian organizations. Retrieved February 18, 2022.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.