S0335 Carbon

malwareEnterprise

platformsWindows

also known asCarbon

Carbon is a sophisticated, second-stage backdoor and framework that can be used to steal sensitive information from victims. Carbon has been selectively used by Turla to target government and foreign affairs-related organizations in Central Asia.

techniques used (18)

ATT&CK techniques this enables or maps to.

T1012Query Registry
T1016System Network Configuration Discovery
T1018Remote System Discovery
T1027Obfuscated Files or Information
T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
T1049System Network Connections Discovery
T1053.005Scheduled Task
T1055.001Dynamic-link Library Injection
T1057Process Discovery
T1069Permission Groups Discovery
T1071.001Web Protocols
T1074.001Local Data Staging
T1095Non-Application Layer Protocol
T1102Web Service
T1124System Time Discovery
T1140Deobfuscate/Decode Files or Information
T1543.003Windows Service
T1573.002Asymmetric Cryptography

used by groups (1)

Threat groups associated with this.

G0010Turla

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan