Associated
with the Russian Federation●
Active over multiple years
●
Active primarily during Moscow business hours
●
Targeted organizations based in the industry control system sector vGoal of gathering intelligence
on ICS-based organizations●
Use of custom malware
Attack and delivery TTPs●
Phishing
●
Watering hole
●
Compromised web servers
Exploitation TTPs●
PDF exploits
●
Java and IE exploits
●
Word exploits2
●
Custom binaries
Post-exploitation TTPs●
Local
system enumeration for OS, username, processes,
internet history, etc.
●
Scan for known ICS-related ports
●
DLL injection to migrate into explorer.exe
●
Collect Outlook address book information
●
Collect
passwords from browsers●
Save exfiltrated data to an encrypted file on disk before delivery to the C in an HTTP
POST request
Share with your friends: 
