ROADSWEEP
Techniques Used |
||||
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1547 | .001 | Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder |
ROADSWEEP has been placed in the start up folder to trigger execution upon user login.(Citation: Microsoft Albanian Government Attacks September 2022) |
| Enterprise | T1059 | .003 | Command and Scripting Interpreter: Windows Command Shell |
ROADSWEEP can open cmd.exe to enable command execution.(Citation: Mandiant ROADSWEEP August 2022)(Citation: Microsoft Albanian Government Attacks September 2022) |
| Enterprise | T1491 | .001 | Defacement: Internal Defacement |
ROADSWEEP has dropped ransom notes in targeted folders prior to encrypting the files.(Citation: Microsoft Albanian Government Attacks September 2022) |
| Enterprise | T1070 | .004 | Indicator Removal: File Deletion |
ROADSWEEP can use embedded scripts to remove itself from the infected host.(Citation: Mandiant ROADSWEEP August 2022)(Citation: Microsoft Albanian Government Attacks September 2022) |
| Enterprise | T1027 | .013 | Obfuscated Files or Information: Encrypted/Encoded File |
The ROADSWEEP binary contains RC4 encrypted embedded scripts.(Citation: Mandiant ROADSWEEP August 2022)(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022) |
| Enterprise | T1553 | .002 | Subvert Trust Controls: Code Signing |
ROADSWEEP has been digitally signed with a certificate issued to the Kuwait Telecommunications Company KSC.(Citation: CISA Iran Albanian Attacks September 2022) |
References
- Jenkins, L. at al. (2022, August 4). ROADSWEEP Ransomware - Likely Iranian Threat Actor Conducts Politically Motivated Disruptive Activity Against Albanian Government Organizations. Retrieved August 6, 2024.
- MSTIC. (2022, September 8). Microsoft investigates Iranian attacks against the Albanian government. Retrieved August 6, 2024.
- CISA. (2022, September 23). AA22-264A Iranian State Actors Conduct Cyber Operations Against the Government of Albania. Retrieved August 6, 2024.
Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.