Frankenstein

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. Frankenstein was described by security researchers as a highly-targeted campaign conducted by moderately sophisticated and highly resourceful threat actors in early 2019. The unidentified actors primarily relied on open source tools, including Empire. The campaign name refers to the actors' ability to piece together several unrelated open-source tool components.(Citation: Talos Frankenstein June 2019)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2019-01-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2019-01-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2019-04-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1057 · Process Discovery

  Discovery — During Frankenstein, the threat actors used Empire to obtain a list of all running processes.(Citation: Talos Frankenstein June 2019)

• T1082 · System Information Discovery

  Discovery — During Frankenstein, the threat actors used Empire to obtain the compromised machine's name.(Citation: Talos Frankenstein June 2019)

• T1027.010 · Command Obfuscation

  Stealth — During Frankenstein, the threat actors ran encoded commands from the command line.(Citation: Talos Frankenstein June 2019)

• T1020 · Automated Exfiltration

  Exfiltration — During Frankenstein, the threat actors collected information via Empire, which was automatically sent back to the adversary's C2.(Citation: Talos Frankenstein June 2019)

• T1053.005 · Scheduled Task

  Execution, Persistence, Privilege Escalation — During Frankenstein, the threat actors established persistence through a scheduled task using the command: `/Create /F /SC DAILY /ST 09:00 /TN WinUpdate /TR`, named "WinUpdate" (Citation: Talos Frankenstein June 2019)

• T1204.002 · Malicious File

  Execution — During Frankenstein, the threat actors relied on a victim to enable macros within a malicious Microsoft Word document likely sent via email.(Citation: Talos Frankenstein June 2019)

• T1566.001 · Spearphishing Attachment

  Initial Access — During Frankenstein, the threat actors likely used spearphishing emails to send malicious Microsoft Word documents.(Citation: Talos Frankenstein June 2019)

• T1105 · Ingress Tool Transfer

  Command And Control — During Frankenstein, the threat actors downloaded files and tools onto a victim machine.(Citation: Talos Frankenstein June 2019)

• T1059.001 · PowerShell

  Execution — During Frankenstein, the threat actors used PowerShell to run a series of Base64-encoded commands that acted as a stager and enumerated hosts.(Citation: Talos Frankenstein June 2019)

• T1518.001 · Security Software Discovery

  Discovery — During Frankenstein, the threat actors used WMI queries to determine if analysis tools were running on a compromised system.(Citation: Talos Frankenstein June 2019)

• T1059.005 · Visual Basic

  Execution — During Frankenstein, the threat actors used Word documents that prompted the victim to enable macros and run a Visual Basic script.(Citation: Talos Frankenstein June 2019)

• T1071.001 · Web Protocols

  Command And Control — During Frankenstein, the threat actors used HTTP GET requests for C2.(Citation: Talos Frankenstein June 2019)

• T1221 · Template Injection

  Stealth — During Frankenstein, the threat actors used trojanized documents that retrieved remote templates from an adversary-controlled website.(Citation: Talos Frankenstein June 2019)

• T1203 · Exploitation for Client Execution

  Execution — During Frankenstein, the threat actors exploited CVE-2017-11882 to execute code on the victim's machine.(Citation: Talos Frankenstein June 2019)

• T1059.003 · Windows Command Shell

  Execution — During Frankenstein, the threat actors ran a command script to set up persistence as a scheduled task named "WinUpdate", as well as other encoded commands from the command-line (Citation: Talos Frankenstein June 2019)

• T1497.001 · System Checks

  Stealth, Discovery — During Frankenstein, the threat actors used a script that ran WMI queries to check if a VM or sandbox was running, including VMWare and Virtualbox. The script would also call WMI to determine the number of cores allocated to the system; if less than two the script would stop execution.(Citation: Talos Frankenstein June 2019)

• T1047 · Windows Management Instrumentation

  Execution — During Frankenstein, the threat actors used WMI queries to check if various security applications were running as well as to determine the operating system version.(Citation: Talos Frankenstein June 2019)

• T1119 · Automated Collection

  Collection — During Frankenstein, the threat actors used Empire to automatically gather the username, domain name, machine name, and other system information.(Citation: Talos Frankenstein June 2019)

• T1036.004 · Masquerade Task or Service

  Stealth — During Frankenstein, the threat actors named a malicious scheduled task "WinUpdate" for persistence.(Citation: Talos Frankenstein June 2019)

• T1005 · Data from Local System

  Collection — During Frankenstein, the threat actors used Empire to gather various local system information.(Citation: Talos Frankenstein June 2019)

• T1041 · Exfiltration Over C2 Channel

  Exfiltration — During Frankenstein, the threat actors collected information via Empire, which sent the data back to the adversary's C2.(Citation: Talos Frankenstein June 2019)

• T1016 · System Network Configuration Discovery

  Discovery — During Frankenstein, the threat actors used Empire to find the public IP address of a compromised system.(Citation: Talos Frankenstein June 2019)

• T1140 · Deobfuscate/Decode Files or Information

  Stealth — During Frankenstein, the threat actors deobfuscated Base64-encoded commands following the execution of a malicious script, which revealed a small script designed to obtain an additional payload.(Citation: Talos Frankenstein June 2019)

• T1588.002 · Tool

  Resource Development — For Frankenstein, the threat actors obtained and used Empire.(Citation: Talos Frankenstein June 2019)

• T1127.001 · MSBuild

  Stealth, Execution — During Frankenstein, the threat actors used MSbuild to execute an actor-created file.(Citation: Talos Frankenstein June 2019)

• T1033 · System Owner/User Discovery

  Discovery — During Frankenstein, the threat actors used Empire to enumerate hosts and gather username, machine name, and administrative permissions information.(Citation: Talos Frankenstein June 2019)

• T1573.001 · Symmetric Cryptography

  Command And Control — During Frankenstein, the threat actors communicated with C2 via an encrypted RC4 byte stream and AES-CBC.(Citation: Talos Frankenstein June 2019)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0001

  Official MITRE ATT&CK campaign record C0001. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.