G0027: Threat Group-3390

Threat Group-3390 has used CVE-2014-6324 and CVE-2017-0213 to escalate privileges.[2]CitationProfero APT27 December 2020

Threat Group-3390 actors have split RAR files for exfiltration into parts.[1]

Threat Group-3390 has exploited the Microsoft SharePoint vulnerability CVE-2019-0604 and CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065 in Exchange Server.[5]

Threat Group-3390 actors use the Hunter tool to conduct network service discovery for vulnerable systems.[1][6]

Threat Group-3390 actors use at to schedule tasks to run self-extracting RAR archives, which install HTTPBrowser or PlugX on other victims on a network.[1]

A Threat Group-3390 tool can spawn `svchost.exe` and inject the payload into that process.[7][3]

Threat Group-3390 has locally staged encrypted archives for later exfiltration efforts.[2]

Threat Group-3390 has exploited CVE-2018-0798 in Equation Editor.[5]

Threat Group-3390 has exfiltrated stolen data to Dropbox.[4]

Threat Group-3390 actors have used a modified version of Mimikatz called Wrapikatz to dump credentials. They have also dumped credentials from domain controllers.[1][2]

Threat Group-3390 has used command-line interfaces for execution.[2][6]

Threat Group-3390 obtained a KeePass database from a compromised host.[4]

Threat Group-3390 has used e-mail to deliver malicious attachments to victims.[4]

A Threat Group-3390 tool can read and decrypt stored Registry values.[7]

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.[1][2]

Threat Group-3390 malware is compressed with LZNT1 compression.[7][3][6]

Threat Group-3390 has lured victims into opening malicious files containing malware.[4]

Threat Group-3390 has used `whoami` to collect system user information.[4]

Threat Group-3390 has hosted malicious payloads on Dropbox.[4]

Threat Group-3390 has used a variety of Web shells.[6]

Threat Group-3390's malware can add a Registry key to `Software\Microsoft\Windows\CurrentVersion\Run` for persistence.[7]CitationLunghi Iron Tiger Linux

A Threat Group-3390 tool can encrypt payloads using XOR. Threat Group-3390 malware is also obfuscated using Metasploit’s shikata_ga_nai encoder.[7][3][6]

Threat Group-3390's malware can create a new service, sometimes naming it after the config information, to gain persistence.[7]CitationLunghi Iron Tiger Linux

Threat Group-3390 has compromised third party service providers to gain access to victim's environments.CitationProfero APT27 December 2020

Threat Group-3390 actors use NBTscan to discover vulnerable systems.[1]

Threat Group-3390 has downloaded additional malware and tools, including through the use of `certutil`, onto a compromised host .[1][4]

Threat Group-3390 actors installed a credential logger on Microsoft Exchange servers. Threat Group-3390 also leveraged the reconnaissance framework, ScanBox, to capture keystrokes.[1][8][3]

Threat Group-3390 has used PowerShell for execution.[2][4]

Threat Group-3390 actors obtain legitimate credentials using a variety of methods and use them to further lateral movement on victim networks.[1]

Threat Group-3390 has embedded malicious code into websites to screen a potential victim's IP address and then exploit their browser if they are of interest.[9]

Threat Group-3390 has obtained and used tools such as Impacket, pwdump, Mimikatz, gsecdump, NBTscan, and Windows Credential Editor.[6][1]

Threat Group-3390 has used the net view command.[7]

Threat Group-3390 has registered domains for C2.CitationLunghi Iron Tiger Linux

Threat Group-3390 has extensively used strategic web compromises to target victims.[1][3]

During execution, Threat Group-3390 malware deobfuscates and decompresses code that was encoded with Metasploit’s shikata_ga_nai encoder as well as compressed with LZNT1 compression.[3]

Threat Group-3390 actors have used gsecdump to dump credentials. They have also dumped credentials from domain controllers.[1][2]

Threat Group-3390 actors look for and use VPN profiles during an operation to access the network using external VPN services.[1] Threat Group-3390 has also obtained OWA account credentials during intrusions that it subsequently used to attempt to regain access when evicted from a victim network.[2]

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.[2]

Threat Group-3390 has used net user to conduct internal discovery of systems.[2]

Threat Group-3390 has compromised the Able Desktop installer to gain access to victim's environments.[5]

A Threat Group-3390 tool can use a public UAC bypass method to elevate privileges.[7]

Threat Group-3390 ran a command to compile an archive of file types of interest from the victim user's directories.[2]

Threat Group-3390 has used RAR to compress, encrypt, and password-protect files prior to exfiltration.[2]

Threat Group-3390 has packed malware and tools, including using VMProtect.[4][5]

Threat Group-3390 has obtained stolen valid certificates, including from VMProtect and the Chinese instant messaging application Youdu, for their operations.CitationLunghi Iron Tiger Linux

A Threat Group-3390 tool can use WMI to execute a binary.[7]

Threat Group-3390 malware has used HTTP for C2.[3]

Threat Group-3390 has detached network shares after exfiltrating files, likely to evade detection.[2]

Threat Group-3390 has used WinRM to enable remote execution.[2]

Threat Group-3390 has performed DLL search order hijacking to execute their payload.[7] Threat Group-3390 has also used DLL side-loading, including by using legitimate Kaspersky antivirus variants as well as `rc.exe`, a legitimate Microsoft Resource Compiler.[1][2][3][6]CitationLunghi Iron Tiger Linux

Threat Group-3390 has deleted existing logs and exfiltrated file archives from a victim.[2][4]

Threat Group-3390 has used appcmd.exe to disable logging on a victim server.[2]

Threat Group-3390 has staged tools, including gsecdump and WCE, on previously compromised websites.[1]

A Threat Group-3390 tool has created new Registry keys under `HKEY_CURRENT_USER\Software\Classes\` and `HKLM\SYSTEM\CurrentControlSet\services`.[7][5]

Threat Group-3390 has moved staged encrypted archives to Internet-facing servers that had previously been compromised with China Chopper prior to exfiltration.[2]

Threat Group-3390 has used `net use` and `netstat` to conduct internal discovery of systems. The group has also used `quser.exe` to identify existing RDP sessions on a victim.[2]