APT 40 Advisory PRC MSS Tradecraft In Action Summary
Tags
cmtmf-attack-pattern: Application Layer Protocol Command And Scripting Interpreter Exploit Public-Facing Application Network Sniffing
country: Australia
maec-delivery-vectors: Watering Hole
attack-pattern: Data Search Victim-Owned Websites Application Layer Protocol - T1437 Command And Scripting Interpreter - T1623 Confluence - T1213.001 Credentials - T1589.001 Credentials From Password Stores - T1555 Credentials In Files - T1552.001 Domain Accounts - T1078.002 Domains - T1583.001 Domains - T1584.001 Exfiltration Over C2 Channel - T1646 Exploitation For Privilege Escalation - T1404 Exploit Public-Facing Application - T1377 Exploits - T1587.004 Exploits - T1588.005 Input Capture - T1417 Ip Addresses - T1590.005 Kerberoasting - T1558.003 Multi-Factor Authentication - T1556.006 Phishing - T1660 Phishing - T1566 Protocol Impersonation - T1001.003 Search Victim-Owned Websites - T1594 Server - T1583.004 Server - T1584.004 Server Software Component - T1505 Smb/Windows Admin Shares - T1021.002 Software - T1592.002 Steal Or Forge Kerberos Tickets - T1558 Steal Web Session Cookie - T1539 Web Portal Capture - T1056.003 Unix Shell - T1059.004 Web Protocols - T1071.001 Web Protocols - T1437.001 Web Shell - T1505.003 Tool - T1588.002 Vulnerabilities - T1588.006 Unix Shell - T1623.001 Standard Application Layer Protocol - T1071 Command-Line Interface - T1059 Connection Proxy - T1090 Data From Information Repositories - T1213 Data Obfuscation - T1001 Exfiltration Over Command And Control Channel - T1041 Exploit Public-Facing Application - T1190 Exploitation For Privilege Escalation - T1068 Input Capture - T1056 Kerberoasting - T1208 Two-Factor Authentication Interception - T1111 Network Service Scanning - T1046 Network Sniffing - T1040 Third-Party Software - T1072 Valid Accounts - T1078 Web Shell - T1100 Data From Information Repositories Exploit Public-Facing Application Network Sniffing Valid Accounts
Show in Graph
Common Information
Type Value
UUID 97c40127-8b69-4a5f-bdcb-d5c4a7a0f36a
Fingerprint b47dd811c1327701
Analysis status DONE
Considered CTI value 2
Text language
Published Oct. 9, 2024, 5:02 p.m.
Added to db Oct. 9, 2024, 8:03 p.m.
Last updated Nov. 17, 2024, 6:56 p.m.
Headline APT 40 Advisory PRC MSS Tradecraft In Action Summary
Title APT 40 Advisory PRC MSS Tradecraft In Action Summary
Detected Hints/Tags/Attributes 116/4/22
Source URLs
Redirection Url
Details Source https://medium.com/@whitehatwes/apt-40-advisory-prc-mss-tradecraft-in-action-summary-9458825703d7?source=rss------cybersecurity-5
URL Provider
Details Provider Source level domain
Details medium.com medium.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 167 ✔ Cybersecurity on Medium https://medium.com/feed/tag/cybersecurity 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details MITRE ATT&CK Techniques 14 
T1594
Details MITRE ATT&CK Techniques 542 
T1190
Details MITRE ATT&CK Techniques 71 
T1078.002
Details MITRE ATT&CK Techniques 695 
T1059
Details MITRE ATT&CK Techniques 50 
T1072
Details MITRE ATT&CK Techniques 104 
T1505.003
Details MITRE ATT&CK Techniques 89 
T1552.001
Details MITRE ATT&CK Techniques 36 
T1558.003
Details MITRE ATT&CK Techniques 139 
T1021.002
Details MITRE ATT&CK Techniques 56 
T1213
Details MITRE ATT&CK Techniques 422 
T1041
Details MITRE ATT&CK Techniques 86 
T1059.004
Details MITRE ATT&CK Techniques 208 
T1068
Details MITRE ATT&CK Techniques 10 
T1056.003
Details MITRE ATT&CK Techniques 25 
T1111
Details MITRE ATT&CK Techniques 42 
T1040
Details MITRE ATT&CK Techniques 99 
T1539
Details MITRE ATT&CK Techniques 168 
T1046
Details MITRE ATT&CK Techniques 442 
T1071.001
Details MITRE ATT&CK Techniques 10 
T1001.003
Details Threat Actor Identifier - APT 143 
APT40
Details Threat Actor Identifier - APT 522 
APT41