APT41 DUST, Campaign C0040 | MITRE ATT&CK® (original) (raw)
Enterprise
Acquire Infrastructure: Serverless
APT41 DUST used infrastructure hosted behind Cloudflare or utilized Cloudflare Workers for command and control.[1]
Enterprise
Application Layer Protocol: Web Protocols
APT41 DUST used HTTPS for command and control.[1]
Enterprise
Archive Collected Data: Archive via Utility
APT41 DUST used rar to compress data downloaded from internal Oracle databases prior to exfiltration.[1]
Enterprise
APT41 DUST used tools such as SQLULDR2 and PINEGROVE to gather local system and database information.[1]
Enterprise
Compromise Accounts: Cloud Accounts
APT41 DUST used compromised Google Workspace accounts for command and control.[1]
Enterprise
Create or Modify System Process: Windows Service
APT41 DUST used Windows Services with names such as Windows Defend for persistence of DUSTPAN.[1]
Enterprise
Data from Information Repositories: Databases
APT41 DUST collected data from victim Oracle databases using SQLULDR2.[1]
Enterprise
Data Staged: Local Data Staging
APT41 DUST involved exporting data from Oracle databases to local CSV files prior to exfiltration.[1]
Enterprise
Encrypted Channel: Asymmetric Cryptography
APT41 DUST used HTTPS for command and control.[1]
Enterprise
Exfiltration Over Web Service: Exfiltration to Cloud Storage
APT41 DUST exfiltrated collected information to OneDrive.[1]
Enterprise
APT41 DUST involved the use of DLL search order hijacking to execute DUSTTRAP.[1] APT41 DUST used also DLL side-loading to execute DUSTTRAP via an AhnLab uninstaller.[1]
Enterprise
Indicator Removal: File Deletion
APT41 DUST deleted various artifacts from victim systems following use.[1]
Enterprise
APT41 DUST involved execution of certutil.exe via web shell to download the DUSTPAN dropper.[1]
Enterprise
Masquerading: Masquerade Task or Service
APT41 DUST disguised DUSTPAN as a legitimate Windows binary such as w3wp.exe or conn.exe.[1]
Enterprise
Obfuscated Files or Information: Encrypted/Encoded File
APT41 DUST used encrypted payloads decrypted and executed in memory.[1]
Enterprise
Obtain Capabilities: Code Signing Certificates
APT41 DUST used stolen code signing certificates to sign DUSTTRAP malware and components.[1]
Enterprise
Search Open Technical Databases: Scan Databases
APT41 DUST used internet scan data for target development.[1]
Enterprise
Search Open Websites/Domains: Search Engines
APT41 DUST involved use of search engines to research victim servers.[1]
Enterprise
APT41 DUST involved access of external victim websites for target development.[1]
Enterprise
Server Software Component: Web Shell
APT41 DUST involved use of web shells such as ANTSWORD and BLUEBEAM for persistence.[1]
Enterprise
Subvert Trust Controls: Code Signing
APT41 DUST used stolen code signing certificates for DUSTTRAP malware and subsequent payloads.[1]
Enterprise
System Services: Service Execution
APT41 DUST used Windows services to execute DUSTPAN.[1]
Enterprise
APT41 DUST used compromised Google Workspace accounts for command and control.[1]