TA2541
TA2541 is a cybercriminal group that has been targeting the aviation, aerospace, transportation, manufacturing, and defense industries since at least 2017. TA2541 campaigns are typically high volume and involve the use of commodity remote access tools obfuscated by crypters and themes related to aviation, transportation, and travel.[1][2]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1047 | Windows管理规范 |
TA2541 has used WMI to query targeted systems for security products.[1] |
|
| Enterprise | T1036 | .005 | 伪装: Match Legitimate Name or Location |
TA2541 has used file names to mimic legitimate Windows files or system functionality.[1] |
| Enterprise | T1573 | .002 | 加密通道: Asymmetric Cryptography |
TA2541 has used TLS encrypted C2 communications including for campaigns using AsyncRAT.[2] |
| Enterprise | T1568 | 动态解析 |
TA2541 has used dynamic DNS services for C2 infrastructure.[1] |
|
| Enterprise | T1547 | .001 | 启动或登录自动启动执行: Registry Run Keys / Startup Folder |
TA2541 has placed VBS files in the Startup folder and used Registry run keys to establish persistence for malicious payloads.[1] |
| Enterprise | T1059 | .001 | 命令与脚本解释器: PowerShell |
TA2541 has used PowerShell to download files and to inject into various Windows processes.[1] |
| .005 | 命令与脚本解释器: Visual Basic |
TA2541 has used VBS files to execute or establish persistence for additional payloads, often using file names consistent with email themes or mimicking system functionality.[1][2] |
||
| Enterprise | T1562 | .001 | 妨碍防御: Disable or Modify Tools |
TA2541 has attempted to disable built-in security protections such as Windows AMSI. [1] |
| Enterprise | T1608 | .001 | 暂存能力: Upload Malware |
TA2541 has uploaded malware to various platforms including Google Drive, Pastetext, Sharetext, and GitHub.[1][2] |
| Enterprise | T1027 | .002 | 混淆文件或信息: Software Packing |
TA2541 has used a .NET packer to obfuscate malicious files.[2] |
| .013 | 混淆文件或信息: Encrypted/Encoded File |
TA2541 has used compressed and char-encoded scripts in operations.[2] |
||
| Enterprise | T1204 | .001 | 用户执行: Malicious Link |
TA2541 has used malicious links to cloud and web services to gain execution on victim machines.[1][3] |
| .002 | 用户执行: Malicious File |
TA2541 has used macro-enabled MS Word documents to lure victims into executing malicious payloads.[1][2][4] |
||
| Enterprise | T1218 | .005 | 系统二进制代理执行: Mshta | |
| Enterprise | T1082 | 系统信息发现 |
TA2541 has collected system information prior to downloading malware on the targeted host.[1] |
|
| Enterprise | T1016 | .001 | 系统网络配置发现: Internet Connection Discovery |
TA2541 has run scripts to check internet connectivity from compromised hosts. [2] |
| Enterprise | T1583 | .001 | 获取基础设施: Domains |
TA2541 has registered domains often containing the keywords "kimjoy," "h0pe," and "grace," using domain registrars including Netdorm and No-IP DDNS, and hosting providers including xTom GmbH and Danilenko, Artyom.[1][2] |
| .006 | 获取基础设施: Web Services |
TA2541 has hosted malicious files on various platforms including Google Drive, OneDrive, Discord, PasteText, ShareText, and GitHub.[1] |
||
| Enterprise | T1588 | .001 | 获取能力: Malware |
TA2541 has used multiple strains of malware available for purchase on criminal forums or in open-source repositories.[1] |
| .002 | 获取能力: Tool | |||
| Enterprise | T1518 | .001 | 软件发现: Security Software Discovery |
TA2541 has used tools to search victim systems for security products such as antivirus and firewall software.[1] |
| Enterprise | T1105 | 输入工具传输 |
TA2541 has used malicious scripts and macros with the ability to download additional payloads.[2] |
|
| Enterprise | T1055 | 进程注入 |
TA2541 has injected malicious code into legitimate .NET related processes including regsvcs.exe, msbuild.exe, and installutil.exe.[1][2] |
|
| .012 | Process Hollowing |
TA2541 has used process hollowing to execute CyberGate malware.[2] |
||
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
TA2541 has sent phishing emails with malicious attachments for initial access including MS Word documents.[1][2] |
| .002 | 钓鱼: Spearphishing Link |
TA2541 has used spearphishing e-mails with malicious links to deliver malware. [1][4] |
||
| Enterprise | T1053 | .005 | 预定任务/作业: Scheduled Task |
TA2541 has used scheduled tasks to establish persistence for installed tools.[1] |
Software
References
- Larson, S. and Wise, J. (2022, February 15). Charting TA2541's Flight. Retrieved September 12, 2023.
- Ventura, V. (2021, September 16). Operation Layover: How we tracked an attack on the aviation industry to five years of compromise. Retrieved September 15, 2023.
- Maniath, S. and Kadam P. (2019, March 19). Dissecting a NETWIRE Phishing Campaign's Usage of Process Hollowing. Retrieved January 7, 2021.