S1124 SocGholish

malwareEnterprise

PlattformenWindows

auch bekannt alsSocGholish · FakeUpdates

SocGholish is a JavaScript-based loader malware that has been used since at least 2017. It has been observed in use against multiple sectors globally for initial access, primarily through drive-by-downloads masquerading as software updates. SocGholish is operated by Mustard Tempest and its access has been sold to groups including Indrik Spider for downloading secondary RAT and ransomware payloads.

genutzte Techniken (19)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

T1016System Network Configuration Discovery
T1027.013Encrypted/Encoded File
T1027.015Compression
T1033System Owner/User Discovery
T1036.005Match Legitimate Resource Name or Location
T1047Windows Management Instrumentation
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
T1057Process Discovery
T1059.007JavaScript
T1074.001Local Data Staging
T1082System Information Discovery
T1102Web Service
T1105Ingress Tool Transfer
T1189Drive-by Compromise
T1204.001Malicious Link
T1482Domain Trust Discovery
T1518Software Discovery
T1566.002Spearphishing Link
T1614System Location Discovery

genutzt von Gruppen (1)

Zugehörige Bedrohungsgruppen.

G1020Mustard Tempest

Quelle

Wo diese Definition veröffentlicht ist.

auf ATT&CK ansehen

scry

Software wie diese trägt bekannte Schwachstellen, sobald sie im Internet exponiert ist. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan