Threat Group-3390

Origen🇨🇳 China

Técnicas (MITRE ATT&CK)57

FuenteMITRE ATT&CK

Patrocinio estatal: UnknownConfianza de atribución: 50%Categorías objetivo: Government, Private sector

Regiones atacadas: United States · United Kingdom · France · Japan · Taiwan · India · Canada · China · Thailand · Israel +5

También conocido como:APT27BRONZE UNIONBudwormCircle TyphoonEMISSARY PANDAEarth SmilodonEmissary PandaG0027GreedyTaotieGroup 35Iron TaurusIron TigerLinen TyphoonLucky MouseLuckyMouseRed PhoenixSHORE CASTLETEMP.HippoTG-3390ZipToken

Sobre el grupo

Threat Group-3390 is a Chinese threat group that has extensively used strategic Web compromises to target victims. The group has been active since at least 2010 and has targeted organizations in the aerospace, government, defense, technology, energy, manufacturing and gambling/betting sectors.

Cadena de ataque

Escenario plausible montado a partir de las técnicas reales del grupo, ordenadas por las fases de un ataque. Cada etapa muestra cómo suele actuar el grupo.

Severidad del arsenal93

Impacto: Alto

Cadena ilustrativa derivada de las técnicas documentadas en MITRE ATT&CK — no representa un ataque específico ya ocurrido. La severidad resume el arsenal conocido (cobertura de la cadena, CVEs en explotación activa, técnicas).

Técnicas (MITRE ATT&CK) 57

Cómo opera el grupo, mapeado por la matriz MITRE ATT&CK y organizado por las fases de un ataque.

Preparación de recursos

Domains Tool Code Signing Certificates Upload Malware Upload Tool Drive-by Target

Acceso inicial

Drive-by Compromise Exploit Public-Facing Application Compromise Software Supply Chain Trusted Relationship Spearphishing Attachment

Ejecución

Windows Management Instrumentation At PowerShell Windows Command Shell Exploitation for Client Execution Malicious File

Persistencia

External Remote Services Web Shell Windows Service Registry Run Keys / Startup Folder

Escalada de privilegios

Exploitation for Privilege Escalation Bypass User Account Control

Acceso a credenciales

LSASS Memory Security Account Manager LSA Secrets Password Managers

Descubrimiento

Query Registry System Network Configuration Discovery Remote System Discovery System Owner/User Discovery Network Service Discovery System Network Connections Discovery Local Account

Movimiento lateral

Windows Remote Management Exploitation of Remote Services

Recolección

Data from Local System Keylogging Local Data Staging Remote Data Staging Automated Collection Archive via Library

Comando y control

Web Protocols Ingress Tool Transfer

Exfiltración

Data Transfer Size Limits Exfiltration to Cloud Storage

defense-impairment

Modify Registry Disable or Modify Windows Event Log

stealth

Software Packing Encrypted/Encoded File Compression Process Hollowing File Deletion Network Share Connection Removal Valid Accounts Deobfuscate/Decode Files or Information DLL

Vulnerabilidades explotadas 12

CVEs que este grupo es conocido por explotar, según MITRE ATT&CK. Ordenadas por gravedad real.

CVE-2021-26855CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2014-7169CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2019-0604CRITICALEPSS 100%KEV MITRE ATT&CK

CVE-2021-27065HIGHEPSS 100%KEV MITRE ATT&CK

CVE-2021-26857HIGHEPSS 96%KEV MITRE ATT&CK

CVE-2018-0798HIGHEPSS 95%KEV MITRE ATT&CK

CVE-2021-26858HIGHEPSS 94%KEV MITRE ATT&CK

CVE-2014-6324HIGHEPSS 87%KEV MITRE ATT&CK

CVE-2017-0213HIGHEPSS 84%KEV MITRE ATT&CK

CVE-2016-6662EPSS 68% MITRE ATT&CK

CVE-2017-0176EPSS 46% MITRE ATT&CK

CVE-2019-3610MEDIUMEPSS 0% MITRE ATT&CK

Infraestructura conocida 2986

Indicadores reales (C2, dominios, URLs y hashes) asociados al malware que usa este grupo. Fuente: abuse.ch (ThreatFox, URLhaus, MalwareBazaar).

ip:port114.215.184.158:8000Cobalt Strikethreatfox

urlhttp://69.49.229.88:443/MQEwCobalt Strikethreatfox

ip:port154.12.17.20:8080Cobalt Strikethreatfox

ip:port154.12.17.20:22Cobalt Strikethreatfox

ip:port154.12.17.20:443Cobalt Strikethreatfox

ip:port154.12.17.20:80Cobalt Strikethreatfox

ip:port129.204.55.230:443Cobalt Strikethreatfox

ip:port47.94.56.71:8080Cobalt Strikethreatfox

ip:port47.94.56.71:80Cobalt Strikethreatfox

ip:port47.94.56.71:443Cobalt Strikethreatfox

ip:port45.227.253.132:8080Cobalt Strikethreatfox

ip:port45.227.253.132:80Cobalt Strikethreatfox

ip:port45.227.253.132:443Cobalt Strikethreatfox

ip:port45.227.253.132:32775Cobalt Strikethreatfox

ip:port117.158.148.164:65535Cobalt Strikethreatfox

ip:port38.76.190.209:8888Cobalt Strikethreatfox

ip:port188.227.14.105:8080Cobalt Strikethreatfox

ip:port186.241.115.168:12443Cobalt Strikethreatfox

ip:port109.206.247.245:10881Cobalt Strikethreatfox

ip:port43.134.112.45:7500Cobalt Strikethreatfox

ip:port43.134.112.45:7000Cobalt Strikethreatfox

ip:port43.134.112.45:80Cobalt Strikethreatfox

ip:port43.134.112.45:8080Cobalt Strikethreatfox

ip:port43.134.112.45:443Cobalt Strikethreatfox

ip:port43.134.112.45:22Cobalt Strikethreatfox

ip:port101.34.208.175:18317Cobalt Strikethreatfox

sha1_hash2ff26540ebb9100dae76a2ae040108ba9338113cCobalt Strikethreatfox

md5_hashe4a34372eab0832d0682fa986a8e0b97Cobalt Strikethreatfox

sha256_hash35afe2df347cb0909fdf2aba8ed6a506a681518a98c0a723b25a16957437f944Cobalt Strikethreatfox

sha256_hash224aec5fec1f907ce152895095f56a3a2f2db0d627633ee691af56a13f34e7f8Cobalt Strikethreatfox

+2986 indicadores en total. Míralos todos en la página de IOCs.

Referencias

El grupo Threat Group-3390 usa técnicas y explota fallas reales. El Pentest Autónomo con IA de TrueHacking simula esos ataques en tu infraestructura y aporta más seguridad a tu aplicación.

Conocer el Pentest Autónomo con IA →