TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.12
- Proofpoint TA2541 February 2022
- Cisco Operation Layover September 2021
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1608.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1568 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.013 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.012 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.015 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2023 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1016.001 | Internet Connection Discovery | — |
| T1027.002 | Software Packing | — |
| T1027.013 | Encrypted/Encoded File | — |
| T1027.015 | Compression | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1047 | Windows Management Instrumentation | — |
| T1053.005 | Scheduled Task | — |
| T1055 | Process Injection | — |
| T1055.012 | Process Hollowing | — |
| T1059.001 | PowerShell | — |
| T1059.005 | Visual Basic | — |
| T1082 | System Information Discovery | — |
| T1105 | Ingress Tool Transfer | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1218.005 | Mshta | — |
| T1518.001 | Security Software Discovery | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1568 | Dynamic Resolution | — |
| T1573.002 | Asymmetric Cryptography | — |
| T1583.001 | Domains | — |
| T1583.006 | Web Services | — |
| T1588.001 | Malware | — |
| T1588.002 | Tool | — |
| T1608.001 | Upload Malware | — |
| T1685 | Disable or Modify Tools | — |
别名
TA2541
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。