^[5]

^[1][6][7]

^{[8][6][3][7][9][5]}

^[2][6]

^[6][3][7][5]

^[7][5]

^[3][7][5]

^[10]

AThreat Group-3390 tool can use a public UAC bypass method to elevate privileges.^[6]

Threat Group-3390 has usednet user to conduct internal discovery of systems.^[2]

Threat Group-3390 has registered domains for C2.^[11]

Threat Group-3390 malware has used HTTP for C2.^[3]

Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.^[2]

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.^[2]

Threat Group-3390's malware can add a Registry key toSoftware\Microsoft\Windows\CurrentVersion\Run for persistence.^[6][11]

Threat Group-3390 has used PowerShell for execution.^[2][4]

Threat Group-3390 has used command-line interfaces for execution.^[2][9]

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.^[6][11]

Threat Group-3390 obtained a KeePass database from a compromised host.^[4]

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.^[2]

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.^[2]

Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised withChina Chopper prior to exfiltration.^[2]

Threat Group-3390 actors have split RAR files for exfiltration into parts.^[1]

During execution,Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.^[3]

Threat Group-3390 has extensively used strategic web compromises to target victims.^[1][3]

Threat Group-3390 has exfiltrated stolen data to Dropbox.^[4]

Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.^[5]

Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.^[5]

Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.^[2][12]

Threat Group-3390 has exploited MS17-010 to move laterally to other systems on the network.^[9]

Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services.^[1]Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.^[2]

Threat Group-3390 has performed DLL search order hijacking to execute their payload.^[6]Threat Group-3390 has also used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well asrc.exe, a legitimate Microsoft Resource Compiler.^{[1][2][3][9][11]}

Threat Group-3390 has used appcmd.exe to disable logging on a victim server.^[2]

Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.^[2][4]

Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.^[2]

Threat Group-3390 has downloaded additional malware and tools, including through the use ofcertutil, onto a compromised host .^[1][4]

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers.Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.^[1][7][3]

AThreat Group-3390 tool has created new Registry keys underHKEY_CURRENT_USER\Software\Classes\ andHKLM\SYSTEM\CurrentControlSet\services.^[6][5]

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.^[1][9]

Threat Group-3390 has packed malware and tools, including using VMProtect.^[4][5]

AThreat Group-3390 tool can encrypt payloads using XOR.Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder.^[6][3][9]

Threat Group-3390 malware is compressed with LZNT1 compression.^[6][3][9]

Threat Group-3390 has obtained and used tools such asImpacket,pwdump,Mimikatz,gsecdump,NBTscan, andWindows Credential Editor.^[9][1]

Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.^[11]

Threat Group-3390 actors have used a modified version ofMimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.^[1][2]

Threat Group-3390 actors have usedgsecdump to dump credentials. They have also dumped credentials from domain controllers.^[1][2]

Threat Group-3390 actors have usedgsecdump to dump credentials. They have also dumped credentials from domain controllers.^[1][2]

Threat Group-3390 has used e-mail to deliver malicious attachments to victims.^[4]

AThreat Group-3390 tool can spawnsvchost.exe and inject the payload into that process.^[6][3]

AThreat Group-3390 tool can read and decrypt stored Registry values.^[6]

Threat Group-3390 has used WinRM to enable remote execution.^[2]

Threat Group-3390 has used thenet view command.^[6]

Threat Group-3390 actors useat to schedule tasks to run self-extracting RAR archives, which installHTTPBrowser orPlugX on other victims on a network.^[1]

Threat Group-3390 has used a variety of Web shells.^[9]

Threat Group-3390 has hosted malicious payloads on Dropbox.^[4]

Threat Group-3390 has staged tools, includinggsecdump and WCE, on previously compromised websites.^[1]

Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.^[8]

Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.^[5]

Threat Group-3390 actors useNBTscan to discover vulnerable systems.^[1]

Threat Group-3390 has usednet use andnetstat to conduct internal discovery of systems. The group has also usedquser.exe to identify existing RDP sessions on a victim.^[2]

Threat Group-3390 has usedwhoami to collect system user information.^[4]

Threat Group-3390 has compromised third party service providers to gain access to victim's environments.^[12]

Threat Group-3390 has lured victims into opening malicious files containing malware.^[4]

Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.^[1]

AThreat Group-3390 tool can use WMI to execute a binary.^[6]