Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Преступная группа APT38
Риски
Каталоги
MITRE ATT&CK
Преступная группа
APT38
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

APT38

APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz August 2020) Active since at least 2014, APT38 has targeted banks, financial institutions, casinos, cryptocurrency exchanges, SWIFT system endpoints, and ATMs in at least 38 countries worldwide. Significant operations include the 2016 Bank of Bangladesh heist, during which APT38 stole $81 million, as well as attacks against Bancomext (Citation: FireEye APT38 Oct 2018) and Banco de Chile (Citation: FireEye APT38 Oct 2018); some of their attacks have been destructive.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: FireEye APT38 Oct 2018)(Citation: DOJ North Korea Indictment Feb 2021)(Citation: Kaspersky Lazarus Under The Hood Blog 2017) North Korean group definitions are known to have significant overlap, and some security researchers report all North Korean state-sponsored cyber activity under the name Lazarus Group instead of tracking clusters or subgroups.
ID: G0082
Associated Groups: Bluenoroff, COPERNICIUM, Stardust Chollima, BeagleBoyz, NICKEL GLADSTONE, Sapphire Sleet
Version: 3.1
Created: 29 Jan 2019
Last Modified: 22 Jan 2025

Associated Group Descriptions
Name Description
Bluenoroff (Citation: Kaspersky Lazarus Under The Hood Blog 2017)
COPERNICIUM (Citation: Microsoft Threat Actor Naming July 2023)
Stardust Chollima (Citation: CrowdStrike Stardust Chollima Profile April 2018)(Citation: CrowdStrike GTR 2021 June 2021)
BeagleBoyz (Citation: CISA AA20-239A BeagleBoyz August 2020)
NICKEL GLADSTONE (Citation: SecureWorks NICKEL GLADSTONE profile Sept 2021)
Sapphire Sleet (Citation: Microsoft Threat Actor Naming July 2023)

Techniques Used
Domain ID Name Use
Enterprise T1548 .002 Abuse Elevation Control Mechanism: Bypass User Account Control

APT38 has used the legitimate application `ieinstal.exe` to bypass UAC.(Citation: 1 - appv)

Enterprise T1583 .001 Acquire Infrastructure: Domains

APT38 has created fake domains to imitate legitimate venture capital or bank domains.(Citation: 1 - appv)

Enterprise T1071 .001 Application Layer Protocol: Web Protocols

APT38 used a backdoor, QUICKRIDE, to communicate to the C2 server over HTTP and HTTPS.(Citation: FireEye APT38 Oct 2018)
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

APT38 has used PowerShell to execute commands and other operational tasks.(Citation: CISA AA20-239A BeagleBoyz August 2020)
.003 Command and Scripting Interpreter: Windows Command Shell

APT38 has used a command-line tunneler, NACHOCHEESE, to give them shell access to a victim’s machine.(Citation: FireEye APT38 Oct 2018) Additionally, APT38 has used batch scripts.(Citation: 1 - appv)

.005 Command and Scripting Interpreter: Visual Basic

APT38 has used VBScript to execute commands and other operational tasks.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: 1 - appv)

Enterprise T1543 .003 Create or Modify System Process: Windows Service

APT38 has installed a new Windows service to establish persistence.(Citation: CISA AA20-239A BeagleBoyz August 2020)
Enterprise T1565 .001 Data Manipulation: Stored Data Manipulation

APT38 has used DYEPACK to create, delete, and alter records in databases used for SWIFT transactions.(Citation: FireEye APT38 Oct 2018)
.002 Data Manipulation: Transmitted Data Manipulation

APT38 has used DYEPACK to manipulate SWIFT messages en route to a printer.(Citation: FireEye APT38 Oct 2018)

.003 Data Manipulation: Runtime Data Manipulation

APT38 has used DYEPACK.FOX to manipulate PDF data as it is accessed to remove traces of fraudulent SWIFT transactions from the data displayed to the end user.(Citation: FireEye APT38 Oct 2018)

Enterprise T1561 .002 Disk Wipe: Disk Structure Wipe

APT38 has used a custom MBR wiper named BOOTWRECK to render systems inoperable.(Citation: FireEye APT38 Oct 2018)
Enterprise T1480 .002 Execution Guardrails: Mutual Exclusion

APT38 has created a mutex to avoid duplicate execution.(Citation: 1 - appv)

Enterprise T1562 .001 Impair Defenses: Disable or Modify Tools

APT38 has unhooked DLLs to disable endpoint detection and response (EDR) or anti-virus (AV) tools.(Citation: 1 - appv)

.003 Impair Defenses: Impair Command History Logging

APT38 has prepended a space to all of their terminal commands to operate without leaving traces in the HISTCONTROL environment.(Citation: CISA AA20-239A BeagleBoyz August 2020)

.004 Impair Defenses: Disable or Modify System Firewall

APT38 have created firewall exemptions on specific ports, including ports 443, 6443, 8443, and 9443.(Citation: CISA AA20-239A BeagleBoyz August 2020)

Enterprise T1070 .001 Indicator Removal: Clear Windows Event Logs

APT38 clears Window Event logs and Sysmon logs from the system.(Citation: FireEye APT38 Oct 2018)
.004 Indicator Removal: File Deletion

APT38 has used a utility called CLOSESHAVE that can securely delete a file from the system. They have also removed malware, tools, or other non-native files used during the intrusion to reduce their footprint or as part of the post-intrusion cleanup process.(Citation: FireEye APT38 Oct 2018)(Citation: CISA AA20-239A BeagleBoyz August 2020)

.006 Indicator Removal: Timestomp

APT38 has modified data timestamps to mimic files that are in the same folder on a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)

Enterprise T1056 .001 Input Capture: Keylogging

APT38 used a Trojan called KEYLIME to capture keystrokes from the victim’s machine.(Citation: FireEye APT38 Oct 2018)
Enterprise T1036 .003 Masquerading: Rename Legitimate Utilities

APT38 has renamed system utilities, such as `rundll32.exe` and `mshta.exe`, to avoid detection.(Citation: 1 - appv)

.006 Masquerading: Space after Filename

APT38 has put several spaces before a file extension to avoid detection and suspicion.(Citation: 1 - appv)

Enterprise T1027 .002 Obfuscated Files or Information: Software Packing

APT38 has used several code packing methods such as Themida, Enigma, VMProtect, and Obsidium, to pack their implants.(Citation: FireEye APT38 Oct 2018)
Enterprise T1588 .002 Obtain Capabilities: Tool

APT38 has obtained and used open-source tools such as Mimikatz.(Citation: ESET Lazarus KillDisk April 2018)
Enterprise T1566 .001 Phishing: Spearphishing Attachment

APT38 has conducted spearphishing campaigns using malicious email attachments.(Citation: CISA AA20-239A BeagleBoyz August 2020)
Enterprise T1053 .003 Scheduled Task/Job: Cron

APT38 has used cron to create pre-scheduled and periodic background jobs on a Linux system.(Citation: CISA AA20-239A BeagleBoyz August 2020)
.005 Scheduled Task/Job: Scheduled Task

APT38 has used Task Scheduler to run programs at system startup or on a scheduled basis for persistence.(Citation: CISA AA20-239A BeagleBoyz August 2020) Additionally, APT38 has used living-off-the-land scripts to execute a malicious script via a scheduled task.(Citation: 1 - appv)

Enterprise T1505 .003 Server Software Component: Web Shell

APT38 has used web shells for persistence or to ensure redundant access.(Citation: CISA AA20-239A BeagleBoyz August 2020)
Enterprise T1518 .001 Software Discovery: Security Software Discovery

APT38 has identified security software, configurations, defensive tools, and sensors installed on a compromised system.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: 1 - appv)
Enterprise T1553 .005 Subvert Trust Controls: Mark-of-the-Web Bypass

APT38 has used ISO and VHD files to deploy malware and to bypass Mark-of-the-Web (MOTW) security measures.(Citation: 1 - appv)

Enterprise T1218 .001 System Binary Proxy Execution: Compiled HTML File

APT38 has used CHM files to move concealed payloads.(Citation: Kaspersky Lazarus Under The Hood APR 2017)
.005 System Binary Proxy Execution: Mshta

APT38 has used a renamed version of `mshta.exe` to execute malicious HTML files.(Citation: 1 - appv)

.007 System Binary Proxy Execution: Msiexec

APT38 has used `msiexec.exe` to execute malicious files.(Citation: 1 - appv)

.011 System Binary Proxy Execution: Rundll32

APT38 has used rundll32.exe to execute binaries, scripts, and Control Panel Item files and to execute code via proxy to avoid triggering security tools.(Citation: CISA AA20-239A BeagleBoyz August 2020)(Citation: 1 - appv)

Enterprise T1569 .002 System Services: Service Execution

APT38 has created new services or modified existing ones to run executables, commands, or scripts.(Citation: CISA AA20-239A BeagleBoyz August 2020)
Enterprise T1204 .001 User Execution: Malicious Link

APT38 has used links to execute a malicious Visual Basic script.(Citation: 1 - appv)

.002 User Execution: Malicious File

APT38 has attempted to lure victims into enabling malicious macros within email attachments.(Citation: CISA AA20-239A BeagleBoyz August 2020) Additionally, APT38 has used malicious Word documents and shortcut files.(Citation: 1 - appv)

Software
ID Name References Techniques
S0039 Net (Citation: FireEye APT38 Oct 2018) (Citation: Microsoft Net Utility) (Citation: Savill 1999) Domain Account, Local Account, Domain Groups, System Service Discovery, Network Share Discovery, Additional Local or Domain Groups, SMB/Windows Admin Shares, Local Account, Domain Account, System Network Connections Discovery, Local Groups, Network Share Connection Removal, Password Policy Discovery, Remote System Discovery, Service Execution, System Time Discovery
S0376 HOPLIGHT (Citation: CISA AA20-239A BeagleBoyz August 2020) (Citation: US-CERT HOPLIGHT Apr 2019) Windows Management Instrumentation, Standard Encoding, Security Account Manager, Device Driver Discovery, System Information Discovery, Process Injection, Disable or Modify System Firewall, Modify Registry, Proxy, File and Directory Discovery, Windows Management Instrumentation Event Subscription, Exfiltration Over C2 Channel, Non-Standard Port, Query Registry, Uncommonly Used Port, Windows Command Shell, Pass the Hash, Ingress Tool Transfer, Service Execution, Fallback Channels, System Time Discovery, Commonly Used Port
S0334 DarkComet (Citation: DarkKomet) (Citation: FYNLOS) (Citation: FireEye APT38 Oct 2018) (Citation: Fynloski) (Citation: Krademok) (Citation: Malwarebytes DarkComet March 2018) (Citation: TrendMicro DarkComet Sept 2014) System Owner/User Discovery, Keylogging, Audio Capture, Match Legitimate Resource Name or Location, Clipboard Data, System Information Discovery, Disable or Modify System Firewall, Modify Registry, Video Capture, Command and Scripting Interpreter, Process Discovery, Registry Run Keys / Startup Folder, Disable or Modify Tools, Windows Command Shell, Software Packing, Web Protocols, Ingress Tool Transfer, Remote Desktop Protocol
S0002 Mimikatz (Citation: Adsecurity Mimikatz Guide) (Citation: Deply Mimikatz) (Citation: FireEye APT38 Oct 2018) Security Account Manager, LSA Secrets, Credentials from Password Stores, Security Support Provider, Rogue Domain Controller, Credentials from Web Browsers, Private Keys, LSASS Memory, Golden Ticket, Pass the Ticket, Steal or Forge Authentication Certificates, Account Manipulation, SID-History Injection, Silver Ticket, Windows Credential Manager, Pass the Hash, DCSync
S0607 KillDisk (Citation: ESEST Black Energy Jan 2016) (Citation: ESET Lazarus KillDisk April 2018) (Citation: KillDisk Ransomware) (Citation: Trend Micro KillDisk 1) (Citation: Trend Micro KillDisk 2) Shared Modules, Disk Structure Wipe, Service Stop, System Information Discovery, Native API, Clear Windows Event Logs, File and Directory Discovery, Masquerade Task or Service, Process Discovery, Obfuscated Files or Information, Data Encrypted for Impact, Data Destruction, File Deletion, Access Token Manipulation, System Shutdown/Reboot
S0593 ECCENTRICBANDWAGON (Citation: CISA AA20-239A BeagleBoyz August 2020) (Citation: CISA EB Aug 2020) Screen Capture, Keylogging, Local Data Staging, Obfuscated Files or Information, Windows Command Shell, File Deletion

References

  1. DHS/CISA. (2020, August 26). FASTCash 2.0: North Korea's BeagleBoyz Robbing Banks. Retrieved September 29, 2021.
  2. SEONGSU PARK. (2022, December 27). BlueNoroff introduces new methods bypassing MoTW. Retrieved February 6, 2024.
  3. CrowdStrike. (2021, June 7). CrowdStrike 2021 Global Threat Report. Retrieved September 29, 2021.
  4. Meyers, Adam. (2018, April 6). Meet CrowdStrike’s Adversary of the Month for April: STARDUST CHOLLIMA. Retrieved September 29, 2021.
  5. Department of Justice. (2021, February 17). Three North Korean Military Hackers Indicted in Wide-Ranging Scheme to Commit Cyberattacks and Financial Crimes Across the Globe. Retrieved June 9, 2021.
  6. Kálnai, P., Cherepanov A. (2018, April 03). Lazarus KillDisks Central American casino. Retrieved May 17, 2018.
  7. SecureWorks. (2021, September 29). NICKEL GLADSTONE Threat Profile. Retrieved September 29, 2021.
  8. GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved April 17, 2019.
  9. GReAT. (2017, April 3). Lazarus Under the Hood. Retrieved October 3, 2018.
  10. Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
  11. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.