Adversaries may buy, steal, or download malware that can be used during targeting. Malicious software can include payloads, droppers, post-compromise tools, backdoors, packers, and C2 protocols. Adversaries may acquire malware to support their operations, obtaining a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. In addition to downloading free malware from the internet, adversaries may purchase these capabilities from third-party entities. Third-party entities can include technology companies that specialize in malware development, criminal marketplaces (including Malware-as-a-Service, or MaaS), or individuals.1 In addition to purchasing malware, adversaries may steal and repurpose malware from third-party entities (including other adversaries).
- BITSIGHT Malware Analysis
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1018 | TA2541 | — |
| grp_g1013 | Metador | — |
| grp_g1014 | LuminousMoth | China |
| grp_g0138 | Andariel | DPRK |
| grp_g0143 | Aquatic Panda | China |
| grp_g0135 | BackdoorDiplomacy | — |
| grp_g1015 | Scattered Spider | — |
| grp_g1048 | UNC3886 | — |
| grp_g0006 | APT1 | China |
| grp_g1004 | LAPSUS$ | — |
| grp_g0069 | MuddyWater | — |
| grp_g1055 | VOID MANTICORE | — |
| grp_g0010 | Turla | Russia |
| grp_g0099 | APT-C-36 | — |
| grp_g0092 | TA505 | — |
| grp_g1003 | Ember Bear | Russia |
| grp_g0140 | LazyScripter | — |
| grp_g1006 | Earth Lusca | China |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.