CostaRicto

Campaign overview

MITRE ATT&CK historical record. Dates reflect source observations. Current activity and target-region classification are not asserted; Global denotes unclassified catalogue coverage. CostaRicto was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. CostaRicto actors targeted organizations in Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia (especially India, Bangladesh, and Singapore), using custom malware, open source tools, and a complex network of proxies and SSH tunnels.(Citation: BlackBerry CostaRicto November 2020)

This is a historical record and does not establish current campaign activity.

Threat actor

Not established

Attribution confidence

Not established

First documented activity

2019-10-01

End date

Not established

Estimated victims

Not established

Reported impact

Not established

Unknown attribution, confidence and impact remain unspecified. Regional labels can include unspecified targets; assess the source evidence before acting.

Documented timeline

1. 2019-10-01

   Source-reported first observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

2. 2020-11-01

   Source-reported last observation; not a claim of current activity or confirmed campaign start/end.

   Source: MITRE ATT&CK

MITRE ATT&CK techniques

• T1046 · Network Service Discovery

  Discovery — During CostaRicto, the threat actors employed nmap and pscan to scan target environments.(Citation: BlackBerry CostaRicto November 2020)

• T1105 · Ingress Tool Transfer

  Command And Control — During CostaRicto, the threat actors downloaded malware and tools onto a compromised host.(Citation: BlackBerry CostaRicto November 2020)

• T1090.003 · Multi-hop Proxy

  Command And Control — During CostaRicto, the threat actors used a layer of proxies to manage C2 communications.(Citation: BlackBerry CostaRicto November 2020)

• T1053.005 · Scheduled Task

  Execution, Persistence, Privilege Escalation — During CostaRicto, the threat actors used scheduled tasks to download backdoor tools.(Citation: BlackBerry CostaRicto November 2020)

• T1588.002 · Tool

  Resource Development — During CostaRicto, the threat actors obtained open source tools to use in their operations.(Citation: BlackBerry CostaRicto November 2020)

• T1133 · External Remote Services

  Persistence, Initial Access — During CostaRicto, the threat actors set up remote tunneling using an SSH tool to maintain access to a compromised environment.(Citation: BlackBerry CostaRicto November 2020)

• T1583.001 · Domains

  Resource Development — For CostaRicto, the threat actors established domains, some of which appeared to spoof legitimate domains.(Citation: BlackBerry CostaRicto November 2020)

• T1587.001 · Malware

  Resource Development — For CostaRicto, the threat actors used custom malware, including PS1, CostaBricks, and SombRAT.(Citation: BlackBerry CostaRicto November 2020)

• T1005 · Data from Local System

  Collection — During CostaRicto, the threat actors collected data and files from compromised networks.(Citation: BlackBerry CostaRicto November 2020)

• T1572 · Protocol Tunneling

  Command And Control — During CostaRicto, the threat actors set up remote SSH tunneling into the victim's environment from a malicious domain.(Citation: BlackBerry CostaRicto November 2020)

Linked indicators

0 reviewed indicators. An indicator’s presence does not establish that every resource on shared infrastructure is malicious.

No reviewed indicators are supplied. None are inferred from the campaign description.

Documented infrastructure

No reviewed infrastructure is supplied.

Sources and evidence

• MITRE ATT&CK C0004

  Official MITRE ATT&CK campaign record C0004. Derived from mitre/cti commit 50be388e93819a5d20e71cbaaeccfda157abc846. Actor links and technique mappings are attributed to this source; confidence, victims, monetary impact and infrastructure are not inferred.

External sources retain their own licences and sharing conditions. Request a correction with supporting evidence.