Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Develop Capabilities: Malware

Other sub-techniques of Develop Capabilities (4)

ID	Название
.001	Malware
.002	Сертификаты подписи кода
.003	Цифровые сертификаты
.004	Эксплойты

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.(Citation: Mandiant APT1)(Citation: Kaspersky Sofacy)(Citation: ActiveMalwareEnergy)(Citation: FBI Flash FIN7 USB) As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of Web Services.(Citation: FireEye APT29)

ID: T1587.001

Относится к технике: T1587

Тактика(-и): Resource Development

Платформы: PRE

Источники данных: Malware Repository: Malware Content, Malware Repository: Malware Metadata

Версия: 1.2

Дата создания: 01 Oct 2020

Последнее изменение: 15 Apr 2025

Название	Описание
Примеры процедур
Kimsuky	Kimsuky has developed its own unique malware such as MailFetch.py for use in operations.(Citation: KISA Operation Muzabi)(Citation: Talos Kimsuky Nov 2021)(Citation: Mandiant APT43 March 2024)
FIN13	FIN13 has utilized custom malware to maintain persistence in a compromised environment.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)
Moonstone Sleet	Moonstone Sleet has developed custom malware, including a malware delivery mechanism masquerading as a legitimate game.(Citation: Microsoft Moonstone Sleet 2024)
Indrik Spider	Indrik Spider has developed malware for their operations, including ransomware such as BitPaymer and WastedLocker.(Citation: Crowdstrike Indrik November 2018)
	During Operation Wocao, threat actors developed their own custom webshells to upload to compromised servers.(Citation: FoxIT Wocao December 2019)
Lazarus Group	Lazarus Group has developed custom malware for use in their operations.(Citation: CISA AppleJeus Feb 2021)(Citation: Google TAG Lazarus Jan 2021)
OilRig	OilRig actively developed and used a series of downloaders during 2022.(Citation: ESET OilRig Downloaders DEC 2023)
LuminousMoth	LuminousMoth has used unique malware for information theft and exfiltration.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)
Sandworm Team	Sandworm Team has developed malware for its operations, including malicious mobile applications and destructive malware such as NotPetya and Olympic Destroyer.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
Salt Typhoon	Salt Typhoon has used custom tooling including JumbledPath.(Citation: Cisco Salt Typhoon FEB 2025)
APT29	APT29 has used unique malware in many of their operations.(Citation: F-Secure The Dukes)(Citation: Mandiant No Easy Breach)(Citation: MSTIC Nobelium Toolset May 2021)(Citation: Mandiant APT29 Eye Spy Email Nov 22)
Play	Play developed and employ Playcrypt ransomware.(Citation: Trend Micro Ransomware Spotlight Play July 2023)(Citation: CISA Play Ransomware Advisory December 2023)
Aoqin Dragon	Aoqin Dragon has used custom malware, including Mongall and Heyoka Backdoor, in their operations.(Citation: SentinelOne Aoqin Dragon June 2022)
	For the SolarWinds Compromise, APT29 used numerous pieces of malware that were likely developed for or by the group, including SUNBURST, SUNSPOT, Raindrop, and TEARDROP.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)
RedCurl	RedCurl has created its own tools to use during operations.(Citation: therecord_redcurl)
Cleaver	Cleaver has created customized tools and payloads for functions including ARP poisoning, encryption, credential dumping, ASP.NET shells, web backdoors, process enumeration, WMI querying, HTTP and SMB communications, network interface sniffing, and keystroke logging.(Citation: Cylance Cleaver)
	For Operation Ghost, APT29 used new strains of malware including FatDuke, MiniDuke, RegDuke, and PolyglotDuke.(Citation: ESET Dukes October 2019)
Moses Staff	Moses Staff has built malware, such as DCSrv and PyDCrypt, for targeting victims' machines.(Citation: Checkpoint MosesStaff Nov 2021)
	In the Triton Safety Instrumented System Attack, TEMP.Veles developed, prior to the attack, malware capabilities that would require access to specific and specialized hardware and software.(Citation: FireEye TRITON Dec 2017)
	ArcaneDoor featured the development and deployment of two unique malware types, Line Dancer and Line Runner.(Citation: CCCS ArcaneDoor 2024)(Citation: Cisco ArcaneDoor 2024)
	For C0010, UNC3890 actors used unique malware, including SUGARUSH and SUGARDUMP.(Citation: Mandiant UNC3890 Aug 2022)
Turla	Turla has developed its own unique malware for use in operations.(Citation: Recorded Future Turla Infra 2020)
	For Juicy Mix, OilRig improved on Solar by developing the Mango backdoor.(Citation: ESET OilRig Campaigns Sep 2023)
	For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.(Citation: BlackBerry CostaRicto November 2020)
UNC2452	UNC2452 developed SUNSPOT, SUNBURST, TEARDROP, and Raindrop; SUNSPOT and SUNBURST were tailored to be incorporated into SolarWind's Orion software library.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: CrowdStrike SUNSPOT Implant January 2021)(Citation: Microsoft Deep Dive Solorigate January 2021)
	For Outer Space, OilRig created new implants including the Solar backdoor.(Citation: ESET OilRig Campaigns Sep 2023)
	For Operation Sharpshooter, the threat actors used the Rising Sun modular backdoor.(Citation: McAfee Sharpshooter December 2018)
Ke3chang	Ke3chang has developed custom malware that allowed them to maintain persistence on victim networks.(Citation: Microsoft NICKEL December 2021)
	Versa Director Zero Day Exploitation involved the development of a new web shell variant, VersaMem.(Citation: Lumen Versa 2024)
	For Operation Dream Job, Lazarus Group developed custom tools such as Sumarta, DBLL Dropper, Torisma, and DRATzarus for their operations.(Citation: ClearSky Lazarus Aug 2020)(Citation: ESET Lazarus Jun 2020)(Citation: McAfee Lazarus Jul 2020)(Citation: McAfee Lazarus Nov 2020)
TeamTNT	TeamTNT has developed custom malware such as Hildegard.(Citation: Unit 42 Hildegard Malware)
Night Dragon	Night Dragon used privately developed and customized remote access tools.(Citation: McAfee Night Dragon)
FIN7	FIN7 has developed malware for use in operations, including the creation of infected removable media.(Citation: FBI Flash FIN7 USB)(Citation: FireEye FIN7 Oct 2019)

Контрмера	Описание
Контрмеры
Pre-compromise	Pre-compromise mitigations involve proactive measures and defenses implemented to prevent adversaries from successfully identifying and exploiting weaknesses during the Reconnaissance and Resource Development phases of an attack. These activities focus on reducing an organization's attack surface, identify adversarial preparation efforts, and increase the difficulty for attackers to conduct successful operations. This mitigation can be implemented through the following measures: Limit Information Exposure: - Regularly audit and sanitize publicly available data, including job posts, websites, and social media. - Use tools like OSINT monitoring platforms (e.g., SpiderFoot, Recon-ng) to identify leaked information. Protect Domain and DNS Infrastructure: - Enable DNSSEC and use WHOIS privacy protection. - Monitor for domain hijacking or lookalike domains using services like RiskIQ or DomainTools. External Monitoring: - Use tools like Shodan, Censys to monitor your external attack surface. - Deploy external vulnerability scanners to proactively address weaknesses. Threat Intelligence: - Leverage platforms like MISP, Recorded Future, or Anomali to track adversarial infrastructure, tools, and activity. Content and Email Protections: - Use email security solutions like Proofpoint, Microsoft Defender for Office 365, or Mimecast. - Enforce SPF/DKIM/DMARC policies to protect against email spoofing. Training and Awareness: - Educate employees on identifying phishing attempts, securing their social media, and avoiding information leaks.

Обнаружение

Consider analyzing malware for features that may be associated with the adversary and/or their developers, such as compiler used, debugging artifacts, or code similarities. Malware repositories can also be used to identify additional samples associated with the adversary and identify development patterns over time. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.