New MerlinAgent Open-Source Tool Used by UAC-0154 Group to Target Ukrainian State Agencies - SOC Prime
Tags
cmtmf-attack-pattern: Boot Or Logon Autostart Execution Command And Scripting Interpreter Masquerading Obfuscated Files Or Information
country: Russia Ukraine
maec-delivery-vectors: Watering Hole
attack-pattern: Boot Or Logon Autostart Execution - T1547 Command And Scripting Interpreter - T1623 Command Obfuscation - T1027.010 Compiled Html File - T1218.001 Compiled Html File - T1223 Exfiltration Over Web Service - T1567 Exfiltration To Cloud Storage - T1567.002 Hidden Window - T1564.003 Hide Artifacts - T1628 Hide Artifacts - T1564 Ingress Tool Transfer - T1544 Javascript - T1059.007 Masquerading - T1655 Obfuscated Files Or Information - T1406 Phishing - T1660 Phishing - T1566 Powershell - T1059.001 Registry Run Keys / Startup Folder - T1547.001 Spearphishing Attachment - T1566.001 Spearphishing Attachment - T1598.002 Spearphishing Link - T1566.002 Spearphishing Link - T1598.003 Windows Command Shell - T1059.003 Transfer Data To Cloud Account - T1537 Tool - T1588.002 Command-Line Interface - T1059 Hidden Window - T1143 Remote File Copy - T1105 Masquerading - T1036 Obfuscated Files Or Information - T1027 Powershell - T1086 Registry Run Keys / Start Folder - T1060 Signed Binary Proxy Execution - T1218 Spearphishing Attachment - T1193 Spearphishing Link - T1192 Masquerading Spearphishing Attachment
Show in Graph
Common Information
Type Value
UUID b6dcce7f-e5e3-407a-8d33-de4540c6290f
Fingerprint f9c53a5f2da5cf81
Analysis status DONE
Considered CTI value 2
Text language
Published Aug. 7, 2023, 12:45 p.m.
Added to db Aug. 7, 2023, 3:01 p.m.
Last updated Nov. 17, 2024, 6:56 p.m.
Headline New MerlinAgent Open-Source Tool Used by UAC-0154 Group to Target Ukrainian State Agencies
Title New MerlinAgent Open-Source Tool Used by UAC-0154 Group to Target Ukrainian State Agencies - SOC Prime
Detected Hints/Tags/Attributes 63/4/11
Source URLs
Redirection Url
Details Source https://socprime.com/blog/new-merlinagent-open-source-tool-used-by-uac-0154-group-to-target-ukrainian-state-agencies/
URL Provider
Details Provider Source level domain
Details socprime.com socprime.com
RSS Feed
Details Id Enabled Feed title Url Added to db
Details 237 ✔ SOC Prime https://socprime.com/feed/ 2024-08-30 22:08
Attributes
Details Type #Events CTI Value
Details CERT Ukraine 10 
UAC-0154
Details MITRE ATT&CK Techniques 100 
T1567.002
Details MITRE ATT&CK Techniques 33 
T1537
Details MITRE ATT&CK Techniques 66 
T1564.003
Details MITRE ATT&CK Techniques 121 
T1218
Details MITRE ATT&CK Techniques 15 
T1218.001
Details MITRE ATT&CK Techniques 25 
T1027.010
Details MITRE ATT&CK Techniques 492 
T1105
Details MITRE ATT&CK Techniques 380 
T1547.001
Details MITRE ATT&CK Techniques 695 
T1059
Details MITRE ATT&CK Techniques 460 
T1059.001