QUIETCANARY

S1076

About this malware

QUIETCANARY is a backdoor tool written in .NET that has been used since at least 2022 to gather and exfiltrate data from victim networks.

Technique	Procedure example
T1012 Query Registry	QUIETCANARY has the ability to retrieve information from the Registry. Mandiant Suspected Turla Campaign February 2023
T1016 System Network Configuration Discovery	QUIETCANARY can identify the default proxy setting on a compromised host. Mandiant Suspected Turla Campaign February 2023
T1071.001 Web Protocols	QUIETCANARY can use HTTPS for C2 communications. Mandiant Suspected Turla Campaign February 2023
T1074 Data Staged	QUIETCANARY has the ability to stage data prior to exfiltration. Mandiant Suspected Turla Campaign February 2023
T1106 Native API	QUIETCANARY can call `System.Net.HttpWebRequest` to identify the default proxy configured on the victim computer. Mandiant Suspected Turla Campaign February 2023
T1132.001 Standard Encoding	QUIETCANARY can base64 encode C2 communications. Mandiant Suspected Turla Campaign February 2023
T1140 Deobfuscate/Decode Files or Information	QUIETCANARY can use a custom parsing routine to decode the command codes and additional parameters from the C2 before executing them. Mandiant Suspected Turla Campaign February 2023
T1564.003 Hidden Window	QUIETCANARY can execute processes in a hidden window. Mandiant Suspected Turla Campaign February 2023
T1573.001 Symmetric Cryptography	QUIETCANARY can RC4 encrypt C2 communications. Mandiant Suspected Turla Campaign February 2023

None recorded.

Mandiant Suspected Turla Campaign February 2023 Open source
Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.