自动化接入 · API / MCP EN

技术说明 · T1587.001

Malware

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors. During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders. As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of Web Services.

ATT&CK T1587.001 platforms — 状态 有效 版本 20.1

Adversaries may develop malware and malware components that can be used during targeting. Building malicious software can include the development of payloads, droppers, post-compromise tools, backdoors (including backdoored images), packers, C2 protocols, and the creation of infected removable media. Adversaries may develop malware to support their operations, creating a means for maintaining control of remote machines, evading defenses, and executing post-compromise behaviors.1234 During malware development, adversaries may intentionally include indicators aligned with other known actors in order to mislead attribution by defenders.567 As with legitimate development efforts, different skill sets may be required for developing malware. The skills needed may be located in-house, or may need to be contracted out. Use of a contractor may be considered an extension of that adversary's malware development capabilities, provided the adversary plays a role in shaping requirements and maintains a degree of exclusivity to the malware. Some aspects of malware development, such as C2 protocol development, may require adversaries to obtain additional infrastructure. For example, malware developed that will communicate with Twitter for C2, may require use of Web Services.8

  1. Mandiant APT1
  2. Kaspersky Sofacy
  3. ActiveMalwareEnergy
  4. FBI Flash FIN7 USB
  5. Olympic Destroyer
  6. Risky Bulletin Threat actor impersonates FSB APT
  7. GamaCopy organization
  8. FireEye APT29

使用该技术的组织

组织名称国家
grp_g0003CleaverIran
grp_g1007Aoqin DragonChina
grp_g1009Moses StaffIran
grp_g1014LuminousMothChina
grp_g1054MirrorFace—
grp_g1056TeamPCP—
grp_g0129Mustang PandaChina
grp_g0032Lazarus GroupDPRK
grp_g1045Salt Typhoon—
grp_g0119Indrik SpiderRussia
grp_g0004Ke3chang—
grp_g1048UNC3886—
grp_g1039RedCurlRussia
grp_g1040Play—
grp_g0049OilRigIran
grp_g1036Moonstone SleetDPRK
grp_g1052Contagious Interview—
grp_g1055VOID MANTICORE—
grp_g1059NIMBUS MANTICORE—
grp_g0046FIN7—
grp_g0010TurlaRussia
grp_g0099APT-C-36—
grp_g0094KimsukyDPRK
grp_g1016FIN13—
grp_g0139TeamTNT—
grp_g0016APT29Russia
grp_g0034Sandworm TeamRussia

断言

尚无指向该技术的公开断言。

记录自动入库·未人工复核；置信度与有效期按引用读取。