Upload Malware
Adversaries may upload malware to third-party or adversary controlled infrastructure to make it accessible during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, and a variety of other malicious content. Adversaries may upload malware to support their operations, such as making a payload available to a victim network to enable Ingress Tool Transfer by placing it on an Internet accessible web server. Malware may be placed on infrastructure that was previously purchased/rented by the adversary (Acquire Infrastructure) or was otherwise compromised by them (Compromise Infrastructure). Malware can also be staged on web services, such as GitHub or Pastebin, or hosted on the InterPlanetary File System (IPFS), where decentralized content storage makes the removal of malicious files difficult. Adversaries may upload backdoored files, such as application binaries, virtual machine images, or container images, to third-party software stores or repositories (ex: GitHub, CNET, AWS Community AMIs, Docker Hub). By chance encounter, victims may directly download/install these backdoored files via User Execution. Masquerading may increase the chance of users mistakenly executing these files.
Open detection, hunting, mitigation, and evidence workspace
Detection logic
If infrastructure or patterns in malware have been previously identified, internet scanning may uncover when an adversary has staged malware to make it accessible for targeting. Much of this activity will take place outside the visibility of the target organization, making detection of this behavior difficult. Detection efforts may be focused on post-compromise phases of the adversary lifecycle, such as User Execution or Ingress Tool Transfer.
Observed actors
G1008Mustard Tempest
G1020Kimsuky
G0094EXOTIC LILY
G1011APT32
G0050Gamaredon Group
G0047TeamTNT
G0139FIN7
G0046Sandworm Team
G0034Mustang Panda
G0129TA2541
G1018Saint Bear
G1031TA505
G0092BITTER
G1002Star Blizzard
G1033LazyScripter
G0140LuminousMoth
G1014Lazarus Group
G0032Earth Lusca
G1006Moonstone Sleet
G1036HEXANE
G1001Threat Group-3390
G0027
