Automation · API / MCP 中文

Technique note · T1587.001

Malware

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders. As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of Web Services.

ATT&CK T1587.001 platforms — Status Active Version 20.1

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.1234 During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders.567 As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of Web Services.8

  1. Mandiant APT1
  2. Kaspersky Sofacy
  3. ActiveMalwareEnergy
  4. FBI Flash FIN7 USB
  5. Olympic Destroyer
  6. Risky Bulletin Threat actor impersonates FSB APT
  7. GamaCopy organization
  8. FireEye APT29

Groups using this technique

GroupNameCountry
grp_g0003CleaverIran
grp_g1007Aoqin DragonChina
grp_g1009Moses StaffIran
grp_g1014LuminousMothChina
grp_g1054MirrorFace—
grp_g1056TeamPCP—
grp_g0129Mustang PandaChina
grp_g0032Lazarus GroupDPRK
grp_g1045Salt Typhoon—
grp_g0119Indrik SpiderRussia
grp_g0004Ke3chang—
grp_g1048UNC3886—
grp_g1039RedCurlRussia
grp_g1040Play—
grp_g0049OilRigIran
grp_g1036Moonstone SleetDPRK
grp_g1052Contagious Interview—
grp_g1055VOID MANTICORE—
grp_g1059NIMBUS MANTICORE—
grp_g0046FIN7—
grp_g0010TurlaRussia
grp_g0099APT-C-36—
grp_g0094KimsukyDPRK
grp_g1016FIN13—
grp_g0139TeamTNT—
grp_g0016APT29Russia
grp_g0034Sandworm TeamRussia

Claims

No public claim points at this technique yet.

Auto-ingested and not human-reviewed; confidence and validity read by citation.