APPENDIX E – Threat profile

• 
  Access and control to Financial Transaction Systems
  

Characterization

• 
  Associated with the Russian Federation
  
• 
  Active over multiple years
  
• 
  Active primarily during Moscow business hours
  
• 
  Targeted organization based in the financial sector
  
• 
  Goal of gathering intelligence on financial based organizations
  

Attack and Delivery TTPs

• 
  Phishing
  
• 
  Watering-Hole
  
• 
  Compromised web servers
  

Exploitation TTPs

• 
  PDF Exploits
  
• 
  JAVA and IE exploits
  
• 
  Custom Binaries
  

Post Exploitation TTPs

• 
  Local system enumeration for OS, username, processes, internet history, etc.
  
• 
  Scan for known transaction related ports
  
• 
  DLL injection to migrate into explorer.exe
  

Persistence TTPs

• 
  Run key registry modifications
  

• 
  HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\”TmProvider”
  
• 
  HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\InternetRegistry