RIPTIDE

RIPTIDE is a proxy-aware backdoor used by APT12. ^[1]

ID: S0003

ⓘ

Type: MALWARE

ⓘ

Platforms: Windows

Version: 1.1

Created: 31 May 2017

Last Modified: 30 March 2020

Techniques Used

Domain	ID		Name	Use
Enterprise	T1573	.001	加密通道: Symmetric Cryptography	APT12 has used the RIPTIDE RAT, which communicates over HTTP with a payload encrypted with RC4.^[1]
Enterprise	T1071	.001	应用层协议: Web Protocols	APT12 has used RIPTIDE, a RAT that uses HTTP to communicate.^[1]

ID	Name	References
G0005	APT12	^[1]